High severity · published Mar 20, 2025
CVE-2024-7767
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
Onyx · Onyx
0.3.94 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7767
Exploit
https://huntr.com/bounties/1425dada-72d8-4bd9-a3e7-2863bb3e1a6c
More from Onyx
9.8
CVE-2025-7894
A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1
6.5
CVE-2026-42277
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
6.5
CVE-2024-9612
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page
5.4
CVE-2025-51479
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH…
4.3
CVE-2026-42276
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions