Read the docs
TI-2024-07201 Aliases CVE-2024-7767GHSA-jv2r-r6r9-hvhj

Improper Access Control in danswer-ai/danswer

Priority HIGH 68CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00601 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
danswer-aidanswer-ai/danswerup to latest—No fix listedCNA
  • danswer-ai/danswer Vendordanswer-ai Affected up to latest Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:onyx:onyx:0.3.94:*:*:*:*:*:*:*0.3.94VulnerableOnyx
  • cpe:2.3:a:onyx:onyx:0.3.94:*:*:*:*:*:*:* Versions 0.3.94 Vulnerable ·Onyx

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7767
  2. 2026-10-03 Alias added: GHSA-jv2r-r6r9-hvhj

References

Exploit 1

  • TI-2024-21753 Unauthorized access to GET/SET of Slack Bot Tokens in Danswer CVSS 3.1CRITICAL 9.8
  • TI-2024-07378 Arbitrary File Overwrite in danswer-ai/danswer CVSS 3.0CRITICAL 9.1
  • TI-2025-00141 Denial of Service in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07442 Denial of Service in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07212 ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07477 CSRF in danswer-ai/danswer CVSS 3.0HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences