medium5.3
CVE-2026-28288
Dify is an open-source LLM app development platform.
Impact
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dify | Dify | before 1.9.0 |