CVE-2024-7767: Improper Access Control in danswer-ai/danswer
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7767?
CVE-2024-7767 is classified as a high severity vulnerability due to its potential for unauthorized data access and manipulation.
How do I fix CVE-2024-7767?
To fix CVE-2024-7767, upgrade to the latest version of danswer-ai/danswer that includes access control enhancements.
What impact does CVE-2024-7767 have on my data?
CVE-2024-7767 can lead to unauthorized users gaining access to sensitive chats, potentially resulting in data breaches or loss.
Who is affected by CVE-2024-7767?
Users of danswer-ai/danswer version v0.3.94 are affected by CVE-2024-7767 due to flawed access controls.
Is there a workaround for CVE-2024-7767 until I can patch?
As of now, the best approach is to minimize user privileges until a patch for CVE-2024-7767 is applied.