CyberRota Analysis
AI-GeneratedQuivr versions up to 0.0.322 are vulnerable due to insufficient validation of chat ownership in key API endpoints, allowing authenticated attackers to access other users' conversation histories, delete chats, and inject messages. This poses a significant risk to user privacy and data integrity, making it critical for organizations using Quivr to prioritize patching or mitigating this vulnerability. Immediate action is recommended for all users of the affected versions to safeguard sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.