CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.

  • Published Aug 28, 2026
  • CVSS 8.6 high
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-82284 at the National Vulnerability Database