SB20260727385 - Multiple vulnerabilities in Dify

Description

This security bulletin contains information about 2 vulnerabilities.

1) Observable Response Discrepancy (CVE-ID: CVE-2026-28288)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to enumerate registered email addresses.

The vulnerability exists due to observable response discrepancy in the /console/api/login endpoint when handling login requests. A remote attacker can send crafted login requests with candidate email addresses to enumerate registered email addresses.

The issue can be identified by differences in API responses for existing accounts versus non-existent accounts.

2) Improper access control (CVE-ID: CVE-2025-59422)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the /console/api/apps/<APP_ID>/chat-messages endpoint when handling requests with a conversation_id parameter. A remote user can send a crafted request using their own bearer token to disclose sensitive information.

Exploitation requires the attacker to be in the same workspace and to know the conversation_id of another user's chat.

Remediation

Install update from vendor's website.

References

• https://github.com/langgenius/dify/security/advisories/GHSA-9qpf-wcv3-w3qx
• https://github.com/langgenius/dify/security/advisories/GHSA-jg5j-c9pq-w894