{"cve":"CVE-2026-41949","nvd":{"published":"2026-05-18T15:16:26.137","modified":"2026-10-14T20:10:00.190","status":"Modified","description":"Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents without ownership or workspace permission verification. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.2},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-639"],"references":["https://github.com/langgenius/dify/commit/432a6412a3fdb30ce48003d699b90cc7d890df20","https://github.com/langgenius/dify/pull/35797","https://github.com/langgenius/dify/releases/tag/1.14.2","https://huntr.com/bounties/d50a0240-7951-4939-b989-9bded66c7682","https://www.vulncheck.com/advisories/dify-authorization-bypass-via-file-preview-endpoint"],"products":["dify:dify"],"source":"nvd","synced_at":"2026-10-19T22:35:16.954578616+00:00"},"epss":{"cve":"CVE-2026-41949","score":0.00435,"percentile":0.37533,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}