CVE-2026-82280

7.1 Élevée

Publiée le 28/08/2026 à 22:20 · Modifiée le 23/09/2026 à 19:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.

Traduire en français

Produits concernés

QuivrHQ quivr

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.1 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/QuivrHQ/quivr
https://github.com/QuivrHQ/quivr/blob/v0.0.322/backend/api/quivr_api/modules/prompt/controller/prompt_routes.py
https://github.com/QuivrHQ/quivr/issues/3698
https://www.vulncheck.com/advisories/quivr-prompt-endpoints-missing-ownership-validation
https://github.com/The-Vibe-Company/Quivr/issues/3698

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories