TI-2024-07201 CVE-2024-7767 · GHSA-jv2r-r6r9-hvhj
Improper Access Control in danswer-ai/danswer
Priority HIGH 68
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94.
Onyx
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Onyx records in CISA KEVNo Onyx vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-30588 CVE-2026-42277
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
Priority MEDIUM 62
Onyx is an open-source AI platform.
TI-2024-08917 CVE-2024-9612 · GHSA-jjhp-4v9p-5fv8
Unauthorized Access in danswer-ai/danswer
Priority MEDIUM 62
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page.
TI-2025-32340 CVE-2025-51479 · GHSA-4v78-j8g9-rpv2
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0…
Priority MEDIUM 58
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-grou…
TI-2025-07218 CVE-2025-7894 · GHSA-656m-7xwx-9vrp
Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection
Priority MEDIUM 57
A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1.
TI-2026-30587 CVE-2026-42276
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
Priority MEDIUM 53
Onyx is an open-source AI platform.