CVE-2026-28288CWE-204

Dify has a user enumeration issue

Medium · published February 27, 2026

CVSS v4.0
5.5
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.

The record
Technical detail
CVSS v4.0
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00728 · 53.6th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-02-27T20:25Z
EPSS history
Timeline
  • 27 FEB 20:25Z
    Dify has a user enumeration issue
    cvelistv5