CVE-2026-82284: Quivrhq Quivr

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.

Affected products

• Quivrhq Quivr: up to and including 0.0.322

Published 2026-08-28. Last modified 2026-09-23.