Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit insufficient permission verification in the chat-messages endpoints to access files without ownership validation, bypassing workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-05 | 2 | Disclosure2 |
| 2026-05-06 | 1 | Disclosure1 |
| 2026-06-23 | 1 | Patch1 |
| 2026-07-06 | 1 | Disclosure1 |
Difyでテナント跨ぎでデータが漏洩する脆弱性群DifyTapについて。CVE-2024-5846、CVE-2026-41947、CVE-2026-41948、CVE-2026-41949、CVE-2026-41950。CVE-2026-41948は未修正。それ以外はバージョン1.14.2で修正。 https://thehackernews.com/2026/06/researchers-detail-difytap-flaws-in.html?m=1
Post summary
The article reports cross‑tenant data leakage vulnerabilities in DifyTap, with most CVEs fixed in version 1.14.2; CVE‑2026‑41948 remains unpatched.
4/ It goes further. CVE-2026-41949 lets you preview documents uploaded by other tenants with nothing but a file UUID. CVE-2026-41950 lets users read files uploaded by other users inside the same tenant. CVE-2026-41948 (CVSS 9.4) is a Plugin Daemon path traversal that can reach internal APIs.
Post summary
The post announces new CVEs (2026-41948/49/50), summarizing their technical aspects and impact without detailing exploitation or fixes.
CVE-2026-41950 Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users w… https://www.cve.org/CVERecord?id=CVE-2026-41950
Post summary
CVE‑2026‑41950 is disclosed as an authorization bypass in Dify prior to v1.14.0 that lets authenticated users read other users’ uploaded file contents. No PoC, exploit code, or patch information is provided.
CVE-2026-41950 Authorization Bypass in Dify Before 1.14.0 Allows Unauthorized File Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41950
Post summary
The text announces CVE-2026-41950, describing an authorization bypass in Dify versions prior to 1.14.0 that permits unauthorized file access, without providing PoC, exploit code, or evidence of active exploitation.
🚨*CVE* CVE-2026-41950 Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users w… https://www.cve.org/CVERecord?id=CVE-2026-41950 ----- Traducción: CVE-2026-41950 Dif… http://infoflow.cloud`
Post summary
An alert reports CVE-2026-41950, an authorization bypass in Dify before v1.14.0 that allows authenticated users to read other users' uploaded files; no PoC, patch, or active exploitation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langgenius | dify | - | node.js | - |