High severity · published Mar 20, 2025
CVE-2024-7767
Improper Access Control in danswer-ai/danswer
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
danswer-ai/danswer · danswer-ai
through latest · source: vendor
ON
Onyx · Onyx
0.3.94 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7767
Exploit
https://huntr.com/bounties/1425dada-72d8-4bd9-a3e7-2863bb3e1a6c
More from danswer-ai/danswer
9.1
CVE-2024-7957
Arbitrary File Overwrite in danswer-ai/danswer
8.1
CVE-2024-8065
CSRF in danswer-ai/danswer
7.5
CVE-2025-0182
Denial of Service in danswer-ai/danswer
7.5
CVE-2024-8028
Denial of Service in danswer-ai/danswer
7.5
CVE-2024-7779
ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer