Description

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users' conversation histories, corrupting state and injecting malicious content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:20:17.950Z",
  "pubdate": "2026-08-28T20:20:17.950Z",
  "executiveSummary": "R2R versions 3.6.5 and earlier suffer from an insecure direct object reference (IDOR) vulnerability within the conversation update and message handling logic.\nThe vulnerability allows authenticated users to bypass authorization checks, enabling them to modify, rename, or append malicious content to conversation histories belonging to other users.\nThis flaw stems from a failure to perform server-side validation of conversation ownership, trusting the user-supplied conversation identifier without verifying the session's authorization to access that resource.\nThe impact is significant, as it leads to state corruption, unauthorized data modification, and potential cross-site scripting (XSS) or social engineering vectors via injected malicious content.\nExploitation requires an active authenticated session, but no specific elevated privileges are necessary to perform the unauthorized actions.\nThe risk implication involves a complete breakdown of data integrity and confidentiality regarding user-to-system interactions.",
  "technicalDetails": "The vulnerability is rooted in a flawed authorization model within the R2R application backend, specifically affecting the conversation update and message handler endpoints.\nThe application relies on user-supplied input to identify conversation targets for updates or message insertion. The root cause is a failure to enforce mandatory ownership checks during the request lifecycle, where the application processes the provided conversation identifier without cross-referencing it against the authenticated user's session identifier or database records confirming access permissions.\nAn attacker can exploit this by intercepting requests to the conversation handler using an interception proxy. By modifying the target conversation identifier (e.g., changing an integer or UUID associated with their own conversation to one associated with a target user's conversation), the attacker can successfully dispatch requests to unauthorized resources.\nThe attack flow follows a predictable sequence: First, the attacker identifies valid conversation identifiers belonging to other users through enumeration or previous interactions. Second, the attacker initiates a legitimate request to the message handler while substituting the target's conversation identifier into the request body or parameters. Third, the backend, failing to validate ownership, executes the requested action—such as renaming the conversation title or appending a new message—within the context of the victim's session.\nThis allows for the systematic corruption of conversation state and the injection of arbitrary content into foreign user histories. The malicious payload behavior can range from simple text modification to the inclusion of malicious scripts or phishing links, which may be rendered when the legitimate user views their conversation history.\nGiven that the application processes these requests once an authenticated state is established, the vulnerability effectively bypasses all intended access controls. The exposure is global for any authenticated user, as there are no granular permission checks protecting conversation objects from being manipulated by peers within the same platform instance.\nPost-exploitation impact includes persistent data tampering, potential unauthorized information disclosure if the attacker can retrieve the modified conversation state, and significant risk of further exploitation through content injection."
}