Danswer Search Page API Bypass Vulnerability

A vulnerability in Danswer version 0.3.94 allows administrators to control the visibility of pages within a workspace, including the search page. When the search page is made invisible, regular users cannot access it or its features from the front-end. However, the back-end fails to check the visibility status, enabling attackers to directly call the API and use the search page's functionalities, circumventing the administrator's restrictions.

Impact

Exploitation of this vulnerability allows for unauthorized access to the search page's API functionalities, bypassing front-end visibility controls.