Vulnerabilities

TI-2026-30588 CVE-2026-42277

Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files

MEDIUM 62

Onyx is an open-source AI platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00201 Published 2026-05-08 Fixed in 3.0.9, 3.1.6 +1 CWE-639

TI-2026-30587 CVE-2026-42276

Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions

MEDIUM 53

Onyx is an open-source AI platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00279 Published 2026-05-08 Fixed in 3.0.9, 3.1.6 +1 CWE-639

TI-2025-32340 CVE-2025-51479 · GHSA-4v78-j8g9-rpv2

Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0…

MEDIUM 58

Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-grou…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00329 Published 2025-07-22 No fix listed CWE-639

TI-2025-07218 CVE-2025-7894 · GHSA-656m-7xwx-9vrp

Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection

MEDIUM 57

A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0061 Published 2025-07-20 No fix listed CWE-74

TI-2024-07201 CVE-2024-7767 · GHSA-jv2r-r6r9-hvhj

Improper Access Control in danswer-ai/danswer

HIGH 68

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00601 Published 2025-03-20 No fix listed CWE-862

TI-2024-08917 CVE-2024-9612 · GHSA-jjhp-4v9p-5fv8

Unauthorized Access in danswer-ai/danswer