Description

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T20:20:19.683Z",
  "pubdate": "2026-08-28T20:20:19.683Z",
  "executiveSummary": "VoltAgent versions up to and including 2.1.20 are susceptible to a critical Broken Object Level Authorization (BOLA) vulnerability within its memory API handlers. This flaw enables authenticated users to bypass ownership validation checks, granting unauthorized access to the conversations and messages of other users. By manipulating object identifiers within API requests, a malicious actor can read, modify, or delete arbitrary data across the application. The vulnerability poses significant risks regarding data confidentiality, integrity, and privacy, as it permits unauthorized cross-account data access without requiring elevated privileges. Successful exploitation requires the attacker to possess a valid authenticated session, after which they can leverage the lack of server-side authorization controls to target specific, unauthorized resources.",
  "technicalDetails": "The vulnerability originates from a failure in the application's API layer to implement adequate server-side authorization checks when processing requests directed at memory endpoints. Specifically, the memory API handlers in VoltAgent fail to validate whether the requester possesses the appropriate ownership rights over the resource identified by the provided identifier.\nIn a secure implementation, the application should verify the relationship between the authenticated user identity (typically derived from a session token or JWT) and the requested resource ID before performing any data operations. In VoltAgent, the API assumes that the inclusion of a resource identifier in the request implies authorization, effectively trusting user-supplied input to define the scope of the operation.\nThe exploitation process follows a predictable pattern: 1. An authenticated attacker authenticates to the application using their legitimate credentials. 2. The attacker identifies the API endpoints responsible for interacting with conversation or message objects. 3. The attacker intercepts or crafts API requests directed at these endpoints, purposefully modifying the identifiers (e.g., conversation IDs or message IDs) to reference resources belonging to other users. 4. Due to the lack of access control validation, the server processes the request as if it were a legitimate operation on the user's own data. 5. The attacker gains the ability to execute CRUD (Create, Read, Update, Delete) operations on these foreign objects.\nBecause the vulnerability exists in the memory API handlers, the scope of impact includes all data managed by these endpoints. An attacker can enumerate conversation IDs to perform bulk exfiltration of private messages, inject malicious content or false information into existing conversations (Modifying), or perform a destructive attack by deleting entire conversation threads, leading to permanent data loss for the victim. Since the application does not enforce the principle of least privilege regarding resource ownership, any authenticated user can effectively act as an administrative user of other accounts, significantly degrading the security posture of the entire platform.\nThis vulnerability is classified as a BOLA issue, exacerbated by the lack of server-side object-level access control (OLAC) and the reliance on client-provided identifiers without an underlying authorization policy enforcement point (PEP) that evaluates user-to-resource permissions during the request lifecycle."
}