Evidence · DiggingBeagle record
GitHub advisory GHSA-w9x9-j56r-h98r, Volto Danswer proxy
Chatbot server authorization failure that forwarded unauthenticated requests with service credentials.
- Source role
- primary disclosure
Evidence record
Chatbot server authorization failure that forwarded unauthenticated requests with service credentials.
Claim-level citations (1)
- supportsVolto chatbot forwarded unauthenticated requests through Danswer service credentials: GHSA-w9x9-j56r-h98r describes a Volto chatbot API route that accepted unauthenticated requests and forwarded them to Danswer using the server-configured credential, until version 2.0.4.
GHSA-w9x9-j56r-h98r, Description, Impact and affected package versions