Read the docs
TI-2024-07477 Aliases CVE-2024-8065GHSA-f64v-mwpx-gv6x

CSRF in danswer-ai/danswer

Priority HIGH 68CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
danswer-aidanswer-ai/danswerup to latest—No fix listedCNA
  • danswer-ai/danswer Vendordanswer-ai Affected up to latest Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8065
  2. 2026-10-03 Alias added: GHSA-f64v-mwpx-gv6x

References

Other 1

  • TI-2024-21753 Unauthorized access to GET/SET of Slack Bot Tokens in Danswer CVSS 3.1CRITICAL 9.8
  • TI-2024-07378 Arbitrary File Overwrite in danswer-ai/danswer CVSS 3.0CRITICAL 9.1
  • TI-2025-00141 Denial of Service in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07442 Denial of Service in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07212 ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07246 CORS Misconfiguration in danswer-ai/danswer CVSS 3.0HIGH 7.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences