Vendor
An unauthenticated Express middleware vulnerability in @eeacms/volto-chatbot allows remote attackers to proxy requests to the Danswer API using the server’s own privileged service credentials.