PT-2026-22397 · Dify · Dify

Kast3T · Published 2026-02-27 · Updated 2026-03-27 · CVE-2026-28288

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.9.0

Description The Dify API exhibits differing responses when queried for existing and non-existent accounts, potentially enabling an attacker to enumerate email addresses registered with the Dify platform. This issue affects the application's ability to protect user information.

Recommendations Update to version 1.9.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-28288

GHSA-9QPF-WCV3-W3QX

Affected Products

Dify

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28288.json · Exploit
• https://github.com/langgenius/dify/security/advisories/GHSA-9qpf-wcv3-w3qx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28288 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28288 · Vendor Advisory
• https://github.com/langgenius/dify/issues/24323 · Note
• https://twitter.com/pdnuclei_bot/status/2037620714673705391 · Twitter Post
• https://t.me/cveNotify/154870 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2027625741005787593 · Twitter Post
• https://twitter.com/CVEnew/status/2027744239333834934 · Twitter Post