VulnSocial

CVE-2026-28288Disclosure(dify / dify)

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.

dify CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-204

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • dify

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-02-28); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
dify
Products
dify

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-02-28: 2Mentions · 2026-03-27: 1PoC Mentioned / Linked · 2026-03-27: 1Technical Details · 2026-02-28: 2Technical Details · 2026-03-27: 102-2803-27
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-02-282
Disclosure2
2026-03-271
Disclosure1
Full discourse3 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-28288 - medium 🚨 Dify User Enumeration via Observable Response Discrepancy > Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from t... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-28288 @pdnuclei #NucleiTemplates #cve

    Post summary

    CVE‑2026‑28288 has been disclosed as a medium‑severity user‑enumeration vulnerability in Dify, with details and potential PoC available via the ProjectDiscovery library – no exploitation, patch, or debunking information is presented.

    00041212
    905 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-28288 Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to… https://www.cve.org/CVERecord?id=CVE-2026-28288

    Post summary

    The CVE-2026-28288 vulnerability in Dify allows attackers to exploit differences in API responses between existing and non‑existent accounts, potentially enabling unauthorized actions.

    00000157
    56.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-28288 Dify API User Enumeration Vulnerability Prior to Version 1.9.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28288

    Post summary

    The text announces a newly disclosed user enumeration vulnerability (CVE‑2026‑28288) affecting Dify API before v1.9.0, but provides no exploitation details, patches, or evidence of active exploitation.

    0000075
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appdifydify---

Explore more

Back to dashboarddify CVEsdify vulnerabilities