{"data":{"id":"0d0c1e3a-c3a1-45c8-b190-540126a36f93","title":"GHSA-w9x9-j56r-h98r: @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy","summary":"@eeacms/volto-chatbot@2.0.3 registers an Express middleware on `**/_v1_da/**` that forwards unauthenticated requests of any HTTP method to the configured Danswer API, attaching the server-side DANSWER_API_KEY or session cookie. Because the path is derived from req.url with no allowlist or method restriction, an unauthenticated attacker can call arbitrary Danswer endpoints, including admin ones, as the service account.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-w9x9-j56r-h98r","publishedAt":"2026-10-29T16:35:48.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@eeacms/volto-chatbot@<= 2.0.3 (fixed: 2.0.4)"],"affectedPackageNames":["@eeacms/volto-chatbot"],"affectedPackageRefs":["npm:@eeacms/volto-chatbot"],"affectedVendors":[],"affectedVendorsRaw":["@eeacms/volto-chatbot","Danswer"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-w9x9-j56r-h98r"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-29T16:35:48.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}