Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 character…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 18, 2026 · NIST NVD

   Detected

   Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents

2. Oct 14, 2026 · NIST NVD

   Updated

   Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents

Affected

• cpe dify/difyversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-41949

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-41949

  30-day exploitation probability 0.6%

  first.org
• NIST NVDVulnerability recordCVE-2026-41949

  Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Attackers can access the

  nvd.nist.gov

References

• Reference · github.com
• Issue Tracking · github.com
• Reference · github.com
• Exploit · huntr.com
• Third Party Advisory · vulncheck.com
• Reference · zafran.io