CVE-2026-82284 - Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations. - 漏洞详情

漏洞编号：CVE-2026-82284

风险等级：高危

漏洞来源：CVE

CVE 编号：CVE-2026-82284

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-639

发布/更新时间：2026-08-28 / 2026-08-28

漏洞描述

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.

漏洞描述

相关链接

相关漏洞