Email Enumeration Vulnerability in Dify Open-Source LLM App Development Platform
CVE-2026-28288

5.5MEDIUM

Key Information:

Vendor

Langgenius

Status
Dify
Vendor
CVE Published:
27 February 2026

What is CVE-2026-28288?

The Dify open-source LLM app development platform contains a vulnerability that allows attackers to differentiate responses from the Dify API for existing and non-existent accounts. This flaw enables potential attackers to perform email enumeration, accessing registered email addresses and compromising user privacy. The issue was addressed in version 1.9.0, which enhances the API's response handling to safeguard user information.

Affected Version(s)

dify < 1.9.0

References

https://github.com/langgenius/dify/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/langgenius/dify/issues/24323
x_refsource_MISC

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.