Dashboard / CVE-2026-41950

CVE-2026-41950

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 62/100
Published: 2026-05-05 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: Present
VC: High
VI: None
VA: None

Description

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit insufficient permission verification in the chat-messages endpoints to access files without ownership validation, bypassing workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
langgenius dify 0 < 1.14.0

References & Advisories (4)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.35%
Raw Score 0.003460
Percentile 28.6%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00346
2026-11-12
0.00346
2026-11-10
0.00346
2026-11-09
0.00346
2026-11-08
0.00346

Intelligence Sources

mitre ref →

External Links