CVE-2026-41949: Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{fileid}/preview endpoint with an intercepted file UUID to extract sensitive content from documents without ownership or workspace permission verification. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 1.14.2 - Compensating control
Restrict access to the file preview endpoint (/console/api/files/{file_id}/preview) at the network layer (e.g., allow only trusted/needed clients) until Dify is upgraded to 1.14.2.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41949?
CVE-2026-41949 is classified as a medium severity vulnerability that permits unauthorized access to sensitive data.
How do I fix CVE-2026-41949?
To address CVE-2026-41949, upgrade Dify to version 1.14.2 or later, which resolves the authorization bypass issue.
Who is affected by CVE-2026-41949?
Any Dify user running version 1.14.1 or earlier is affected by CVE-2026-41949.
What type of vulnerability is CVE-2026-41949?
CVE-2026-41949 is an authorization bypass vulnerability that impacts the file preview endpoint.
Can CVE-2026-41949 lead to data exposure?
Yes, CVE-2026-41949 can allow authenticated users to read parts of any uploaded document, potentially exposing sensitive data.