CVE-2026-41950 is an authorization bypass vulnerability in langgenius's dify product before version 1.14.0. Authenticated users can exploit insufficient permission verification in the chat-messages API endpoint by providing arbitrary file UUIDs in the files array of requests. This flaw allows them to read the full contents of files uploaded by other users within the same tenant, bypassing workspace separation and signed URL protections. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality.

An attacker with authenticated access to dify can read sensitive files uploaded by other users in the same tenant without proper authorization. This compromises confidentiality by exposing potentially sensitive data across workspace boundaries. There is no indication of impact on integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user permissions to the minimum necessary and monitor for unusual access patterns involving file UUIDs in chat-messages requests. Avoid sharing sensitive files in affected versions if possible.