CVE-2024-8057: Danswer-Ai Danswer-Ai/danswer

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to admin users. This can lead to excessive resource consumption, potentially resulting in a Denial of Service (DoS) and other significant issues, impacting the system's stability and security.

Affected products

• Danswer-Ai Danswer-Ai/danswer: affected versions not specified

Published 2025-03-20. Last modified 2026-06-17.