PT-2026-37239 · Dify · Dify

Published 2026-05-05 · Updated 2026-05-06 · CVE-2026-41950

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.14.0

Description An authorization bypass allows authenticated users to read the full contents of files uploaded by other users within the same tenant. This occurs due to insufficient permission verification in the 'chat-messages' endpoint, which fails to validate file ownership. By supplying an arbitrary file UUID in the files array of a 'chat-messages' request, attackers can bypass workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing.

Recommendations Update to version 1.14.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-41950

Affected Products

Dify

References · 8

• 🔥 https://huntr.com/bounties/181136ec-d957-4b75-8ea7-6fa7b8abd01d · Exploit
• https://github.com/langgenius/dify/releases/tag/1.14.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41950 · Security Note
• https://twitter.com/infoflowcloud/status/2051779366250525075 · Twitter Post
• https://twitter.com/CVEnew/status/2051777786843443583 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051900348135022743 · Twitter Post
• https://t.me/CVEtracker/52800 · Telegram Post
• https://vulncheck.com/advisories/dify-authorization-bypass-via-file-uuid · Note