QuivrHQ vulnerabilities
We track 2 vulnerabilities in QuivrHQ products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
2vulnerabilities
0critical
2high
0exploited
7.6average CVSS score
Latest QuivrHQ vulnerabilities
- 8.1 High severity
quivr: Authorization Bypass Through User-Controlled Key
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including privat
- 7.1 High severity
quivr: Authorization Bypass Through User-Controlled Key
Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting