CVE-2026-82280 in Quivr
Summary
by MITRE • 08/28/2026
Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within Quivr versions up to 0.0.322 represents a critical failure in server-side object level authorization, specifically categorized under CWE-639: Authorization Bypass Through User-Controlled Key. This flaw resides in the application's prompt management endpoints, which are designed to handle user interactions with AI models and associated data structures known as brains. In a properly secured system, any request to modify or delete resources must verify that the requesting authenticated user is the legitimate owner of those specific resources. However, Quivr fails to perform this validation check when processing updates to prompt identifiers. Consequently, an attacker who possesses valid authentication credentials can manipulate the input parameters sent to these endpoints to target arbitrary prompts belonging to other users within the same ecosystem.
The operational impact of this vulnerability is severe due to its potential for widespread system compromise and data integrity loss. Because Quivr facilitates shared collaboration through brains, which are essentially collections of documents and configurations accessible by multiple users, the ability to overwrite prompts affects all members associated with that brain. An attacker does not need elevated privileges or administrative rights; read-only access to a shared brain is sufficient to enumerate exposed prompt identifiers. Once these identifiers are obtained, typically via network traffic analysis or API enumeration tools, the attacker can craft malicious requests to inject arbitrary text into system-level prompts. This action effectively hijacks the behavior of the AI assistant for every user in that group, potentially leading to data exfiltration, generation of harmful content, or bypassing of safety filters implemented by the brain's original creators.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078: Valid Accounts, as it relies on legitimate authentication credentials rather than exploitation of unauthenticated entry points. Furthermore, the mechanism of modifying system prompts to alter application behavior can be viewed through the lens of T1562: Impair Defenses, specifically sub-technique T1562.001: Disable or Modify Tools, if the modified prompts are used to disable security logging or monitoring features within the AI context. The lack of ownership validation also reflects a broader pattern often seen in RESTful API design where resource identifiers are treated as public rather than private by default without explicit access control checks.
To mitigate this vulnerability, developers must implement strict authorization controls on all prompt modification endpoints. This involves ensuring that every request to update or delete a prompt includes a server-side verification step that confirms the authenticated user's identity matches the owner field of the target resource record in the database. Additionally, implementing role-based access control can restrict write operations to users with explicit edit permissions for specific brains rather than relying solely on ownership checks. Input validation should also be enforced to ensure that only expected data types and formats are processed by these endpoints. For organizations currently running affected versions, immediate patching to version 0.0.323 or later is required. In the interim, network-level controls such as Web Application Firewalls can be configured to monitor for unusual patterns of prompt modification requests originating from users who do not typically perform administrative actions on shared resources.