An attacker can determine whether an email address is registered with the Dify platform by sending API requests that elicit different responses for existing versus non‑existent accounts. This leads to a privacy violation where an adversary can gather email addresses of users without authorization. The weakness is classified as CWE‑204, indicating lack of adequate access controls that expose sensitive data through response variation.

The vulnerability affects installations of Dify, a platform for building LLM‑based applications, developed by langgenius, running any version prior to 1.9.0. The vulnerability is not present in the 1.9.0 release or later.

The CVSS base score of 5.5 indicates moderate severity, with low exploitation probability as reflected by an EPSS score of less than 1 percent. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, implying no confirmed exploitation at the time of analysis. Exploitation requires only the ability to send API requests to the service; no privileged access or additional conditions are necessary.