CVE-2026-28288: Dify has a user enumeration issue
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 1.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28288?
CVE-2026-28288 is classified as a medium severity vulnerability due to its potential for user enumeration.
How do I fix CVE-2026-28288?
To fix CVE-2026-28288, upgrade to Dify version 1.9.0 or later.
What type of vulnerability is CVE-2026-28288?
CVE-2026-28288 is an enumeration vulnerability that allows attackers to differentiate between existing and non-existent accounts.
Who is affected by CVE-2026-28288?
Users of Dify prior to version 1.9.0 are affected by CVE-2026-28288.
What can attackers do with CVE-2026-28288?
Attackers can use CVE-2026-28288 to enumerate and validate email addresses registered with the Dify platform.