CVE-2026-82271

CVE-2026-82271 is an authorization bypass (CWE-639, insecure direct object reference) in R2R through 3.6.5: the conversation update and message handlers do not verify that a conversation identifier supplied by the caller belongs to that user. An authenticated user can submit a conversation ID owned by another user over the network (CVSS vector: AV:N/PR:L/UI:N) to rename that conversation or append new messages to it. The attacker gains unauthorized modification of other users' conversation state and can inject malicious or misleading content, with integrity impact rated high and no confidentiality impact per the CVSS scoring. Any R2R deployment running version 3.6.5 or earlier whose conversation endpoints are reachable by authenticated users is affected. No exploitation is currently known: there is no public proof-of-concept, it is not listed in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to the first R2R release after 3.6.5 once available (the fixed version is not specified in the available data) and verify the fix adds server-side ownership validation of conversation identifiers in the update and message handlers. As interim mitigation, limit which authenticated accounts can reach the conversation endpoints and monitor conversation histories for unexpected renames or appended messages. Since exploitation requires valid credentials, review any shared or low-trust accounts if conversation tampering is suspected.