CVE-2026-82280

Quivr through version 0.0.322 does not validate that the requester owns a prompt in its prompt endpoints, an authorization bypass flaw (CWE-639) that lets any authenticated user modify any prompt by supplying its identifier. An attacker holding only read-only access to a shared brain can read exposed prompt identifiers and then overwrite system prompts, changing the assistant's behavior for all users of that brain. Exploitation requires valid low-privilege credentials but no user interaction, is reachable over the network, and primarily tampers with prompt content (high integrity impact, limited confidentiality impact). Any Quivr deployment up to and including 0.0.322 is affected, with the greatest risk in multi-user or shared-brain setups such as team and hosted instances. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known, and EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to a Quivr release newer than 0.0.322 that restores ownership checks on prompt endpoints as soon as a patched version is published (no fixed version is specified in the available data). Until then, treat system prompts in shared brains as tamperable: review them for unexpected edits, restrict which read-only or low-privilege users can access shared brains, and monitor prompt endpoints for modifications by accounts that do not own the prompts.