CVE-2024-7767 Improper Access Control in danswer-ai/danswer
First user can view, modify, and delete admin chats, leading to unauthorized access and data integrity loss in Danswer AI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7767?
CVE-2024-7767 is a medium-severity missing authorization vulnerability in danswer-ai/danswer, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.
Weakness: CWE-862
Which versions are affected by CVE-2024-7767?
It affects 1 product.
Products include Onyx Onyx.
How do I fix CVE-2024-7767?
No fix has been published for CVE-2024-7767 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-7767 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7767 exists.
Other vulnerabilities in danswer-ai/danswer
- CVE-2026-42277 Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
- CVE-2024-9612 Unauthorized Access in danswer-ai/danswer
- CVE-2025-51479 Missing authorization in n/a
- CVE-2025-7894 Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection
- CVE-2026-42276 Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
Sources
Also known as GHSA-jv2r-r6r9-hvhj.