# CVE-2026-41950: LangGenius Dify authorization bypass in chat-messages endpoint

Source: https://junglewise.ai/threats/cve-2026-41950-langgenius-dify-authorization-bypass-in-chat-messages-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-41950 · Severity: medium · CVSS 6.5 · Published 2026-05-05

Dify is an open-source platform used to build and manage AI applications and workflows. A security flaw allowed logged-in users to view files uploaded by other people within the same organization or tenant. By exploiting this, an attacker could bypass privacy protections to access sensitive documents, images, or data used in AI chats.

Technologies: [Langgenius Dify](https://junglewise.ai/threats/technologies/dify). Vendors: [Langgenius](https://junglewise.ai/threats/vendors/langgenius).

## Quick answers

**Is CVE-2026-41950 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41950 being exploited in the wild.

**How severe is CVE-2026-41950?** Medium severity, with a CVSS score of 6.5, published 5 May 2026.

**Which products and versions are affected?** Langgenius Dify < 1.14.0, before 1.14.0.

**Is there a fix for CVE-2026-41950?** A patch was published on 2026-04-29: Version 1.14.0 released on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41950 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-41950?** Check whether you run Langgenius Dify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in Dify's chat-messages endpoints due to insufficient permission verification. Authenticated users can supply an arbitrary file UUID in the 'files' array of a chat-messages request to access files they do not own. This flaw allows attackers to bypass workspace separation and signed URL protections, retrieving sensitive file contents through workflow processing. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and was addressed in version 1.14.0.

## Affected products

- LangGenius Dify before 1.14.0

## Timeline

- 2026-04-29: patched: Version 1.14.0 released on GitHub
- 2026-05-05: disclosed: Initial vulnerability disclosure and NVD publication
- 2026-06-22: advisory: Detailed security blog post by Zafran Security published

## References

- [https://github.com/langgenius/dify/releases/tag/1.14.0](https://github.com/langgenius/dify/releases/tag/1.14.0)
- [https://huntr.com/bounties/181136ec-d957-4b75-8ea7-6fa7b8abd01d](https://huntr.com/bounties/181136ec-d957-4b75-8ea7-6fa7b8abd01d)
- [https://www.vulncheck.com/advisories/dify-authorization-bypass-via-file-uuid](https://www.vulncheck.com/advisories/dify-authorization-bypass-via-file-uuid)
- [https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps](https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps)

## Related threats

- [langgenius dify hard-coded credentials in sandbox](https://junglewise.ai/threats/cve-2026-123135-a-vulnerability-was-found-in-langgenius-dify-up-to-1-18-0-2-0-0)
- [Dify authorization bypass in MCP server endpoint](https://junglewise.ai/threats/cve-2026-105761-dify-is-an-open-source-llm-app-development-platform-prior-to-1)
- [langgenius dify DOM-based XSS in redirect URL handler](https://junglewise.ai/threats/cve-2026-85022-langgenius-dify-dom-based-xss-in-redirect-url-handler)
- [langgenius Dify DOM-based XSS in splash.tsx redirect](https://junglewise.ai/threats/cve-2026-85021-langgenius-dify-dom-based-xss-in-splash-tsx-redirect)
- [LangGenius Dify server-side template injection in Jinja2 handler](https://junglewise.ai/threats/cve-2026-18632-langgenius-dify-server-side-template-injection-in-jinja2-handler)