Executive brief
Dify, an open-source platform for building AI applications, contains a security flaw in its file preview feature. This vulnerability allows any registered user to view the first 3,000 characters of documents uploaded by other organizations or users if they know the document's unique ID. Because Dify Cloud allows free self-registration, an attacker can easily create an account to exploit this flaw and access sensitive business data or private documents across different workspaces.
Technical details
An authorization bypass (CWE-639) exists in the `/console/api/files/{file_id}/preview` endpoint of Dify. The root cause is a failure in the `FilePreviewApi.get` controller and the underlying `FileService.get_file_preview` method to verify tenant ownership; the application retrieves files based solely on the provided UUID without checking if the requesting user belongs to the file's tenant. An attacker with a valid session (easily obtained via self-registration) can extract the first 3,000 characters of any document if they possess or can intercept the file's UUID. The vulnerability has been addressed in a pull request that adds a tenant-id filter to the database lookup query.
Affected products
- LangGenius Dify <= 1.14.1
Timeline
- 2026-05-05: other: Initial patch submitted via pull request
- 2026-05-14: patched: Patch merged into main branch
- 2026-05-18: advisory: CVE published and NVD record created