Authorization Bypass in Quivr Prompt Management

Quivr versions up to and including 0.0.322 contain a critical authorization vulnerability (CVE-2026-82280) within its prompt management endpoints. The application fails to perform adequate ownership validation when processing requests to modify prompts. This allows any authenticated user, including those with only read-only access to shared 'brains', to discover valid prompt identifiers and subsequently issue unauthorized requests to overwrite them. By successfully altering these system prompts, an attacker can modify the behavior of the AI model for all users who interact with the affected shared environment. This vulnerability poses a significant risk to the integrity of AI-driven workflows and could be leveraged to perform prompt injection at scale or disrupt service delivery across an entire organizational brain.

Impact

Successful exploitation enables an attacker to manipulate AI model responses by overwriting system prompts, potentially affecting all users connected to a compromised shared brain. This can lead to unauthorized information disclosure, the injection of malicious instructions, and a complete loss of control over the AI-generated output for specific tasks within the Quivr platform.

Recommendation

• Upgrade Quivr to a version beyond 0.0.322 as soon as a patch is available.
• Implement restrictive API gateway controls to audit access to prompt-related endpoints until the vulnerability is remediated.
• Audit logs for unauthorized POST, PUT, or PATCH requests directed at prompt modification endpoints by accounts with restricted or read-only privileges.
• Monitor for anomalous prompt identifier discovery patterns in web server logs originating from low-privilege service accounts.