CVE-2024-7767mediumCWE-862

CVE-2024-7767: medium-severity vulnerability in danswer-ai/danswer

Improper Access Control in danswer-ai/danswer

Published · Updated

Follow this CVE+ Monitor danswer-ai/danswer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.6%
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
danswer-ai · danswer-ai/danswer
Related CVEs — danswer-ai/danswer

In the same product, most dangerous first.

CVE-2024-9617MEDIUMIDOR in danswer-ai/danswerEPSS 1.7%CVE-2024-7957CRITICALArbitrary File Overwrite in danswer-ai/danswerEPSS 1.0%CVE-2024-9612MEDIUMUnauthorized Access in danswer-ai/danswerEPSS 0.7%CVE-2025-0182HIGHDenial of Service in danswer-ai/danswerEPSS 0.7%CVE-2024-7779HIGHReDoS (Regular Expression Denial of Service) in danswer-ai/danswerEPSS 0.7%CVE-2024-8028HIGHDenial of Service in danswer-ai/danswerEPSS 0.5%