CVE-2026-82284 in Quivr
Summary
by MITRE • 08/28/2026
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/29/2026
Quivr versions through 0.0.322 contain a critical access control vulnerability that stems from the failure to validate chat ownership during API interactions. This flaw affects endpoints responsible for retrieving conversation history, deleting specific chats, and submitting new questions or answers within existing conversations. Specifically, the GET /chat/{chat_id}/history endpoint allows retrieval of past messages without verifying if the requesting user is the owner of the chat session. Similarly, the DELETE /chat/{chat_id} endpoint permits the removal of any chat regardless of ownership, while the POST /chat/{chat_id}/question/answer endpoint enables authenticated users to inject fabricated or malicious content into conversations they do not own. This lack of authorization checks represents a fundamental breakdown in secure design principles, allowing attackers with valid credentials for one account to manipulate data associated with other accounts within the same system.
The operational impact of this vulnerability is severe and multifaceted. First, authenticated attackers can exfiltrate sensitive conversation histories from other users. Since Quivr often serves as an interface for interacting with private knowledge bases containing proprietary or confidential information, unauthorized access to chat history effectively grants read-only access to these underlying data assets. This constitutes a significant confidentiality breach where intellectual property and personal communications are exposed without consent. Second, the ability to delete arbitrary chats allows attackers to perform denial of service attacks against specific users by erasing their work history or context windows, disrupting productivity and potentially causing loss of critical information that was not backed up elsewhere. Third, the capability to inject fabricated messages into other users' conversations poses a serious integrity risk. Attackers can manipulate the conversation flow, introduce misleading instructions, or poison the data used for future AI responses, thereby compromising the reliability and trustworthiness of the system's outputs.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting issues related to insufficient authorization checks in web applications. The attack vector leverages broken object level permissions (BOLA), which is categorized under MITRE ATT&CK technique T1530 as Data from Information Repositories when used for exfiltration, and potentially T1608 Install Defacement or similar manipulation techniques depending on the specific payload injected into the chat history. The vulnerability exploits the assumption that possession of a valid session token implies permission to access all resources identified by IDs within those tokens, ignoring the necessity of verifying resource ownership against the authenticated user's identity.
Mitigation strategies must prioritize immediate patching and robust authorization implementation. Users running Quivr versions up to 0.0.322 should upgrade to the latest stable release where these endpoints have been secured with proper ownership validation logic. For organizations unable to immediately update, implementing a reverse proxy or Web Application Firewall rule can help mitigate risk by inspecting API requests for patterns indicative of unauthorized access attempts, although this is not a substitute for fixing the root cause. Developers must ensure that all state-changing and data-retrieval endpoints enforce strict object-level authorization checks, verifying that the authenticated user's ID matches the owner_id field associated with the requested chat resource before processing any request. Additionally, implementing rate limiting on these endpoints can help reduce the blast radius of automated exploitation attempts while longer-term architectural improvements are deployed to enhance overall access control governance within the application layer.