Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-7767Improper Access Control in danswer-ai/danswer
Medium 6.5
In plain English
A medium-severity missing authorization in danswer-ai/danswer from danswer-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.0)6.5Medium
Exploit odds (30 days)0.6%top 51.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| danswer-ai | danswer-ai/danswer | unspecified – through latest |
Weakness: CWE-862 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N