The report
A chatbot may need a backend credential to retrieve indexed company documents, but that credential does not establish what an individual user is allowed to read. The Volto integration advisory describes a generic route that accepted requests without the required caller authorization and forwarded them to Danswer with the service's configured credentials. As a result, an unauthenticated client able to reach the Volto endpoint could invoke functions within that downstream service credential's scope.
The documented fix is version 2.0.4. The attack requires the affected Danswer integration and a reachable route; the report does not demonstrate access to every document in a deployment or name victims whose private records were taken. Its consequence depends on the grants assigned to the service credential, which may be much broader than those of a public website visitor.
The proxy acted as a confused deputy
The model need not issue a harmful instruction or bypass its own refusal behavior. Ordinary HTTP calls can exploit the gap if the application treats possession of a server-side Danswer credential as a substitute for authenticating the real caller. Every proxied operation must be tied to an authorized user and resource, while the backend credential should itself carry the minimum necessary privileges.
The Case describes that principal-to-backend boundary, which differs from a poisoned retrieval document or a model hallucination even though all three can arise in AI-backed search systems.