CVE-2026-82284: Quivr Authentication Bypass Vulnerability

CVE-2026-82284 Overview

CVE-2026-82284 is an insecure direct object reference (IDOR) vulnerability [CWE-639] in Quivr, an open-source AI knowledge assistant. Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories, delete arbitrary chats, and inject fabricated messages into other users' conversations. The exposed conversation histories can include private knowledge base content indexed by victim users.

Critical Impact
Any authenticated Quivr user can enumerate chat IDs to read private conversations, tamper with other users' chat histories, and destroy chat records without authorization.

Affected Products

Quivr versions through 0.0.322
Quivr backend chat routes controller (backend/api/quivr_api/modules/chat/controller/chat_routes.py)
Deployments exposing the affected REST API to multiple tenants or users

Discovery Timeline

2026-08-28 - CVE-2026-82284 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82284

Vulnerability Analysis

Quivr exposes chat resources through REST endpoints keyed by a chat_id path parameter. The affected endpoints authenticate the caller but do not verify that the authenticated principal owns the chat identified by chat_id. As a result, any valid session can operate on any chat in the system.

Three operations are exposed by the flaw. GET /chat/{chat_id}/history returns the full message history, including responses generated from the victim's private knowledge base. DELETE /chat/{chat_id} removes chats belonging to other users. POST /chat/{chat_id}/question/answer appends attacker-controlled question and answer pairs to a victim's conversation, enabling history tampering and prompt-injection style manipulation of downstream review or training workflows.

Because Quivr is used as an AI assistant over uploaded documents, disclosed chat histories frequently contain sensitive extracts from internal documentation, source code, or personally identifiable information. See the VulnCheck Advisory for Quivr for additional detail.

Root Cause

The root cause is missing authorization on object references [CWE-639] in the chat routes controller. The handlers resolve chat_id directly from the request path and query the datastore without an ownership predicate matching the authenticated user ID. Authentication is enforced, but authorization is not, breaking the access control model expected for multi-user deployments.

Attack Vector

Exploitation requires only low-privileged authenticated access to the Quivr API over the network. An attacker registers or reuses a normal account, enumerates or guesses chat UUIDs, and issues requests against the three affected endpoints. No user interaction is required. Refer to the GitHub Chat Routes Controller and GitHub Issue #3697 for the vulnerable code path.

Detection Methods for CVE-2026-82284

Indicators of Compromise

Application log entries where the authenticated user ID does not match the owner of the requested chat_id on /chat/{chat_id}/history, /chat/{chat_id}, or /chat/{chat_id}/question/answer.
High-volume enumeration of sequential or randomized chat_id UUIDs from a single account or IP address.
Unexpected DELETE requests to /chat/{chat_id} from accounts that did not create the target chats.
New question/answer entries in chat histories that users report they did not submit.

Detection Strategies

Correlate the authenticated principal in each API request with the owner attribute of the referenced chat record and alert on mismatches.
Implement rate-limiting and anomaly detection on chat endpoints to flag ID enumeration behavior.
Review historical access logs for cross-tenant chat_id access preceding the patch deployment.

Monitoring Recommendations

Forward Quivr application and reverse proxy logs to a centralized analytics platform and retain them for retrospective hunting.
Track baseline request patterns per user and alert on deviations in DELETE and history-read volume.
Monitor the Quivr repository for security releases via the GitHub Repository for Quivr.

How to Mitigate CVE-2026-82284

Immediate Actions Required

Restrict Quivr API exposure to trusted networks or an authenticated reverse proxy until a fixed release is deployed.
Audit chat records for unauthorized deletions or injected messages and restore from backups where required.
Rotate API tokens and force re-authentication for accounts that may have been abused for enumeration.

Patch Information

At the time of publication, no fixed version beyond 0.0.322 is referenced in the NVD entry. Monitor the GitHub Repository for Quivr and GitHub Issue #3697 for an upstream fix. The remediation must enforce an ownership check that compares the authenticated user ID against the chat.user_id field before executing any read, delete, or append operation on chat_id.

Workarounds

Deploy an API gateway or middleware that injects the authenticated user ID and validates ownership against a chat-to-user mapping before proxying requests to Quivr.
Limit each Quivr instance to a single trusted user or tenant to eliminate cross-user access until the code is patched.
Disable the affected endpoints at the reverse proxy for deployments that do not require chat history retrieval, deletion, or programmatic answer submission.

bash

# Example NGINX rule to block the vulnerable endpoints at the edge
location ~ ^/chat/[^/]+/(history|question/answer)$ {
    return 403;
}
location ~ ^/chat/[^/]+$ {
    if ($request_method = DELETE) { return 403; }
    proxy_pass http://quivr_backend;
}