CVE-2026-41949: 
Dify vulnerability analysis and mitigation

CVE-2026-41949 is an authorization bypass vulnerability in Dify's file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. It affects Dify versions up to and including 1.14.1, and was disclosed on May 18, 2026, with a patch released in version 1.14.2. The vulnerability was reported by Ido Shani (@zafran-io) via the Huntr bug bounty platform. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is an Insecure Direct Object Reference / Authorization Bypass Through User-Controlled Key (CWE-639) in api/controllers/console/files.py. The FilePreviewApi.get endpoint authenticated the caller but passed only the file_id to FileService.get_file_preview(), which queried the UploadFile table by UUID alone — with no tenant_id filter. An attacker who obtains or guesses a valid file UUID can call GET /console/api/files/{file_id}/preview and receive the first 3,000 characters of the target document regardless of tenant or workspace membership. The fix, merged in PR #35797, adds UploadFile.tenant_id == tenant_id to the database lookup and resolves the caller's tenant via current_account_with_tenant() before the query (GitHub PR #35797, GitHub Advisory).

Successful exploitation allows an attacker to exfiltrate up to 3,000 characters of extracted text from any document uploaded to the Dify platform, spanning all tenants and workspaces — effectively breaking multi-tenant data isolation. On Dify Cloud, where free self-registration is permitted without prior approval, this means any external party can create an account and immediately begin harvesting sensitive document content from other organizations. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach that could expose proprietary data, PII, or confidential business documents stored across the platform (Feedly, GitHub Advisory).

A proof-of-concept was submitted via Huntr (bounty d50a0240-7951-4939-b989-9bded66c7682), though the public page contains no exploit code or reproduction steps. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.03–0.04% (12th percentile), indicating low near-term exploitation probability. On Dify Cloud, the effective privilege requirement is none, since free account registration is open to anyone (Feedly, GitHub Advisory).

1. Account Creation: On Dify Cloud, register a free account without any approval process. For self-hosted instances, obtain any valid authenticated session.
2. File UUID Discovery: Intercept network traffic (e.g., via browser developer tools or a proxy like Burp Suite) while interacting with the Dify UI to capture file UUIDs from API responses, or enumerate UUIDs if predictable patterns exist.
3. Craft the Request: Send an authenticated HTTP GET request to the vulnerable endpoint using the captured UUID:

   GET /console/api/files/<target_file_uuid>/preview
   Authorization: Bearer <your_session_token>

4. Extract Document Content: The server returns a JSON response {"content": "<first 3000 chars of document text>"} belonging to any tenant or workspace, without verifying that the requesting user owns or has access to the file.
5. Iterate: Repeat with additional UUIDs to harvest content from multiple documents across different tenants (GitHub PR #35797, GitHub Advisory).

• Network: Repeated authenticated GET requests to /console/api/files/<uuid>/preview from a single account, especially targeting UUIDs not associated with that account's workspace; high volume of preview requests across many distinct UUIDs in a short time window.
• Logs: API access logs showing GET /console/api/files/*/preview requests returning HTTP 200 for file IDs belonging to tenants other than the requesting user's tenant; requests originating from newly registered accounts with no other activity.
• Behavioral: A single user account generating preview requests for files across multiple tenant namespaces; automated or scripted request patterns (consistent timing, sequential UUID enumeration) targeting the preview endpoint.

Upgrade Dify to version 1.14.2 or later, which includes the fix merged in PR #35797 (commit 432a641). The patch adds a tenant_id filter to the FileService.get_file_preview() database query and resolves the caller's tenant in the controller before passing it to the service layer. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. As additional hardening, consider implementing rate limiting on the /console/api/files/*/preview endpoint and enabling audit logging for all file access attempts (GitHub Release 1.14.2, GitHub PR #35797).

The vulnerability was discovered and reported by security researcher Ido Shani (@zafran-io) through the Huntr bug bounty platform. The fix was contributed by the reporter and applied by Dify maintainer xr843 on his behalf, as noted in the PR discussion. VulnCheck published an advisory covering the issue. Social media activity was limited to automated CVE tracking posts on Bluesky. No significant broader media coverage or notable community debate has been observed (GitHub PR #35797, GitHub Advisory).