Description

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T20:20:19.213Z",
  "pubdate": "2026-08-28T20:20:19.213Z",
  "executiveSummary": "Quivr, in versions up to 0.0.322, is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within its prompt management API endpoints. The flaw stems from a failure to perform server-side authorization checks to verify whether the authenticated user possesses the necessary permissions to modify a specific prompt resource.\nThe vulnerability allows an authenticated user, including those with restricted read-only access to a shared brain, to identify and overwrite existing prompt configurations. By manipulating prompt identifiers, an attacker can replace legitimate system or user prompts with malicious or unauthorized content. This integrity breach affects all users associated with the targeted brain, effectively compromising the behavior of the AI interface for the entire user group. The risk is significant, as it enables unauthorized modification of system-level logic and data manipulation, which could lead to prompt injection attacks, data exfiltration, or the subversion of AI output integrity. Successful exploitation requires an authenticated session but leverages the lack of granular ownership validation to bypass intended security controls.",
  "technicalDetails": "The root cause of this vulnerability is the absence of adequate access control checks (authorization) within the application logic governing prompt manipulation endpoints. While the system authenticates the user, it fails to perform an ownership validation verify step before executing update operations on prompt objects indexed by a unique identifier.\nThe attack flow begins with an authenticated user identifying the prompt ID associated with a brain. In scenarios involving shared brains, users with read-only privileges can query the API to list or view exposed prompt identifiers. Once an attacker possesses a valid prompt identifier, they can craft an unauthorized HTTP PUT or PATCH request directed at the prompt modification endpoint. Because the backend fails to validate whether the authenticated user is the legitimate owner or has write access to the specific resource, the application processes the request, overwriting the existing prompt data in the database with the attacker-supplied payload.\nThis vulnerability is particularly critical because it affects centralized system prompts. By overwriting these configurations, an attacker can force the application to adhere to new instructions that govern the behavior of the AI assistant for all users who access that specific brain. This results in a persistent, broad-scope compromise of the system's instructions. The vulnerability is strictly an authorization failure where the server-side code relies solely on the user's presence in the system without validating the authorization context of the requested operation against the resource owner.\nAffected component: Prompt management API endpoints. Affected versions: Up to 0.0.322. Authentication requirements: Attacker must have a valid authenticated session. Privilege requirements: Low (read-only access to a shared brain is sufficient to facilitate discovery). Post-exploitation impact includes the total loss of integrity for prompt-based workflows, the potential for persistent cross-user prompt injection, and the ability to misdirect AI responses for all users within a compromised brain context."
}