CVE-2026-41950 is an authorization bypass vulnerability in langgenius's dify product prior to version 1.14.0. Authenticated users can exploit insufficient permission verification in the chat-messages API by providing arbitrary file UUIDs in the files array, allowing them to read files uploaded by other users within the same tenant. This bypasses workspace separation and signed URL protections, exposing sensitive file contents through workflow processing. The vulnerability is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with authenticated access can read the full contents of files uploaded by other users in the same tenant without proper authorization. This compromises data confidentiality within the affected environment by bypassing workspace separation and signed URL protections. There is no indication of privilege escalation beyond the authenticated user level or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize exposure and monitor for unusual file access patterns. Avoid sharing sensitive files within the affected versions. Upgrading to version 1.14.0 or later is implied but not confirmed as a fix; verify with vendor advisories.