CVE-2026-41950

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit insufficient permission verification in the chat-messages endpoints to access files without ownership validation, bypassing workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2026
Last modified: Jul 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-419518.6Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the serve CVE-2026-419527.8Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before bu CVE-2026-419538.7A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can CVE-2026-419544.9Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allo CVE-2026-419567.5When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM)CVE-2026-419578.8An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. No CVE-2026-419586.5A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)).CVE-2026-419596.5Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iCon CVE-2026-41969.8A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS CVE-2026-419605.8Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-419615.9Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-419623.6Permission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulnerability may affect