CVE-2026-41950: Dify < 1.14.0 Authorization Bypass via File UUID
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit insufficient permission verification in the chat-messages endpoints to access files without ownership validation, bypassing workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Difyto a version that resolves this vulnerability.Fixed in 1.14.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41950?
CVE-2026-41950 is rated as a high severity vulnerability due to its potential to allow unauthorized access to sensitive user data.
How do I fix CVE-2026-41950?
To fix CVE-2026-41950, upgrade Dify to version 1.14.0 or later, which addresses the authorization bypass issue.
Who is affected by CVE-2026-41950?
Authenticated users on Dify versions prior to 1.14.0 are affected by CVE-2026-41950 and can exploit the authorization bypass vulnerability.
What types of data can be accessed through CVE-2026-41950?
CVE-2026-41950 allows users to access the full contents of files uploaded by other users within the same tenant.
Is CVE-2026-41950 a common vulnerability?
CVE-2026-41950 represents a common type of vulnerability known as an authorization bypass, particularly affecting multi-user applications.