CVE-2026-41950 is an authorization bypass vulnerability in langgenius's dify product prior to version 1.14.0. Authenticated users can supply arbitrary file UUIDs in the files array of chat-messages requests to read files uploaded by other users within the same tenant. The root cause is insufficient permission verification in the chat-messages endpoints, which fails to validate file ownership and bypasses workspace separation and signed URL protections. This allows unauthorized access to sensitive file contents through workflow processing.

The vulnerability allows authenticated users with limited privileges to access files they do not own within the same tenant. This can lead to unauthorized disclosure of sensitive information stored in uploaded files. The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, and partial privileges required. There is no indication of privilege escalation or integrity/availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and remediationLevel is null, users should monitor the vendor's announcements for updates. Until a fix is available, restrict authenticated user permissions where possible and avoid sharing sensitive files in affected versions. Do not rely solely on signed URL protections as they are bypassed by this vulnerability.