CVE-2024-7767CWE-862

Improper Access Control in danswer-ai/danswer

Medium · published March 20, 2025

CVSS v3.0
6.5
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00601 · 48.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-03-20T10:11Z
EPSS history
Timeline
  • 20 MAR 10:11Z
    Improper Access Control in danswer-ai/danswer
    cvelistv5