Dashboard / CVE-2026-41949

CVE-2026-41949

HIGH
MEDIUM Priority: 0.04 BB Relevance: 76/100
Published: 2026-05-18 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
AT: None
VC: High
VI: None
VA: None

Description

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents without ownership or workspace permission verification. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
langgenius dify 0 < 1.14.2

References & Advisories (6)

Bug Bounty Relevance

76 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.43%
Raw Score 0.004350
Percentile 38.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00435
2026-11-12
0.00435
2026-11-10
0.00435
2026-11-09
0.00435
2026-11-08
0.00435

Intelligence Sources

mitre ref →

External Links