CVE-2026-28288 — Dify has a user enumeration issue
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate …
Published: 2026-02-27 · CVSS: 5.5 · CVSS 4.0
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7