CVE-2026-82284 — Quivr Chat Endpoints Missing Ownership Validation
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Au…
Published: 2026-08-28 · CVSS: 8.6 · CVSS 4.0
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7