← Database

CVE-2026-28288

MEDIUM CVSS: 5.3 Published: 2026-02-27 Modified: 2026-06-17

Description

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.

Affected Platforms

Dify Dify

Weakness Type

CWE-204

References