Read the docs
TI-2024-08917 Aliases CVE-2024-9612GHSA-jjhp-4v9p-5fv8

Unauthorized Access in danswer-ai/danswer

Priority MEDIUM 62CWE-1100Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end does not verify the visibility status of the search page. Consequently, attackers can directly call the API to access the functionalities provided by the search page, bypassing the visibility restriction set by the administrator.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00734 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
danswer-aidanswer-ai/danswerup to latest—No fix listedCNA
  • danswer-ai/danswer Vendordanswer-ai Affected up to latest Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:onyx:onyx:0.3.94:*:*:*:*:*:*:*0.3.94VulnerableOnyx
  • cpe:2.3:a:onyx:onyx:0.3.94:*:*:*:*:*:*:* Versions 0.3.94 Vulnerable ·Onyx

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-9612
  2. 2026-10-03 Alias added: GHSA-jjhp-4v9p-5fv8

References

Exploit 1

  • TI-2024-21753 Unauthorized access to GET/SET of Slack Bot Tokens in Danswer CVSS 3.1CRITICAL 9.8
  • TI-2024-07378 Arbitrary File Overwrite in danswer-ai/danswer CVSS 3.0CRITICAL 9.1
  • TI-2025-00141 Denial of Service in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07442 Denial of Service in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07212 ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer CVSS 3.0HIGH 7.5
  • TI-2024-07477 CSRF in danswer-ai/danswer CVSS 3.0HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences