@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
@eeacms/volto-chatbot exposes an Express middleware route (/_v1_da/) that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Danswer API, automatically attaching the server-side service credentials (DANSWER_API_KEY or session cookie). Because no authorization check, path allowlist, or method restriction is applied before the upstream request is issued, an unauthenticated attacker can invoke arbitrary Danswer API operations — including privileged admin endpoints — as the configured …