P4Verified

CVE-2026-41949: dify through 1.14.1 (inclusive), 0 to before 1.14.2

CVE-2026-41949. CVSS 3.1 base score 7.5 (HIGH, NVD). EPSS 0.00566 (percentile 0.45485), scored 13-Oct-2026.

Affected technology

dify · through 1.14.1 (inclusive)
dify

dify · 0 to before 1.14.2
langgenius

Description’s affected range: before version 1.14.2

Component: Not specified by the source
File: preview

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Any authenticated user can read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID. Vendor/CNA’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 15-Oct-2026 01:10 UTC

CWE: CWE-639
CCR priority: 30.1 /100 (P4)
CVSS 3.1: 7.5 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · NVD
EPSS: 0.00566 · percentile 0.45485 · 2026-10-13
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-15 01:07:31.726917+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-41949.html