CVE-2026-41949 is an authorization bypass vulnerability affecting Dify version 1.14.1 and prior. The issue exists in the /console/api/files/{file_id}/preview endpoint, which allows any authenticated user to access partial content (up to 3,000 characters) of any uploaded document by supplying the document's UUID. The endpoint fails to enforce ownership or workspace permission checks, enabling cross-tenant data exposure. The vulnerability is exacerbated by the fact that Dify Cloud allows unauthenticated users to self-register accounts, lowering the barrier for attackers to exploit this flaw. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

An attacker with any authenticated account on Dify can access sensitive content from documents they do not own or have permission to view, potentially exposing confidential information across tenants and workspaces. Because Dify Cloud allows free self-registration without authentication barriers, attackers can easily create accounts to exploit this vulnerability. The impact is limited to reading up to 3,000 characters per document preview request but affects confidentiality significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the file preview endpoint, monitoring for unusual access patterns, and limiting account creation if possible. Since no official patch or temporary fix is documented, users should follow vendor updates closely.