CVE-2026-82284

HIGH 8.1

Quivr Chat Endpoints Missing Ownership Validation

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.

CWE	CWE-639
Vendor	quivrhq
Product	quivr
Published	Aug 28, 2026
Last Updated	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for quivrhq quivr

Be the first to know when new high vulnerabilities affecting quivrhq quivr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

QuivrHQ / quivr

0 ≤ 0.0.322

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/QuivrHQ/quivr/issues/3697 github.com: https://github.com/QuivrHQ/quivr github.com: https://github.com/QuivrHQ/quivr/blob/v0.0.322/backend/api/quivr_api/modules/chat/controller/chat_routes.py vulncheck.com: https://www.vulncheck.com/advisories/quivr-chat-endpoints-missing-ownership-validation

Credits

🔍 George Chen