Executive brief
Dify is an open-source platform used to build and manage AI applications and workflows. A security flaw allowed logged-in users to view files uploaded by other people within the same organization or tenant. By exploiting this, an attacker could bypass privacy protections to access sensitive documents, images, or data used in AI chats.
Technical details
An authorization bypass exists in Dify's chat-messages endpoints due to insufficient permission verification. Authenticated users can supply an arbitrary file UUID in the 'files' array of a chat-messages request to access files they do not own. This flaw allows attackers to bypass workspace separation and signed URL protections, retrieving sensitive file contents through workflow processing. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and was addressed in version 1.14.0.
Affected products
- LangGenius Dify before 1.14.0
Timeline
- 2026-04-29: patched: Version 1.14.0 released on GitHub
- 2026-05-05: disclosed: Initial vulnerability disclosure and NVD publication
- 2026-06-22: advisory: Detailed security blog post by Zafran Security published
References
- https://github.com/langgenius/dify/releases/tag/1.14.0
- https://huntr.com/bounties/181136ec-d957-4b75-8ea7-6fa7b8abd01d
- https://www.vulncheck.com/advisories/dify-authorization-bypass-via-file-uuid
- https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps