CVE-2026-28288: Dify

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.

Affected products

• Dify Dify: before 1.9.0 (fixed in 1.9.0)

Published 2026-02-27. Last modified 2026-06-17.