quivr vulnerabilities

2 known vulnerabilities in quivr from QuivrHQ. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  quivr: Authorization Bypass Through User-Controlled Key

  CVE-2026-82284Aug 28, 2026QuivrHQ

  Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including privat

• 7.1 High severity

  quivr: Authorization Bypass Through User-Controlled Key

  CVE-2026-82280Aug 28, 2026QuivrHQ

  Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting