CVE-2026-41949 is an authorization bypass vulnerability in langgenius's Dify product affecting versions before 1.14.2. The vulnerability exists in the /console/api/files/{file_id}/preview endpoint, where an authenticated user can supply a file UUID to retrieve a preview of up to 3,000 characters of any uploaded document, regardless of tenant or workspace permissions. This allows unauthorized access to sensitive document content. The vulnerability is exacerbated by Dify Cloud's policy of allowing unauthenticated free self-registration, facilitating attacker account creation. No official remediation level or patch information is provided in the available data.

An attacker with any authenticated account can bypass authorization controls to read partial contents of any uploaded document across all tenants and workspaces. This leads to unauthorized disclosure of potentially sensitive information. The ability to create accounts freely on Dify Cloud lowers the barrier for exploitation. There is no indication of privilege escalation or data modification, but confidentiality is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file preview endpoint to trusted users only and monitor for suspicious use of file UUIDs. Consider disabling or limiting the preview functionality if feasible. Review account creation policies to reduce ease of attacker registration.