VoltAgent CVE-2026-13511

The attacker must hold a valid authenticated session on the VoltAgent instance (PR:L per CVSS 4.0 - unauthenticated exploitation is not possible). VoltAgent must be deployed in a multi-user configuration where more than one user's conversations are stored in shared memory storage. The attacker must reach the Memory REST API over the network (AV:N). Attack complexity is rated high (AC:H), reflecting the requirement to know or enumerate a valid victim conversationId value, which is a non-trivial prerequisite and the primary limiting factor. Exploitation is further limited by the niche deployment footprint of VoltAgent and the requirement for the memory REST API to be accessible to the attacker's user account. Single-user deployments, deployments where memory endpoints are firewalled from untrusted users, and deployments with per-user isolated storage are not meaningfully at risk. Impact is read-only access to conversation history; no write, delete, or privilege-escalation capability is confirmed by the described vulnerability, though related handlers in the same PR may share the same flaw.

Real-world risk is low-to-moderate and tightly scoped to multi-user VoltAgent deployments. The CVSS 4.0 base score of 2.3 is coherent with the attack profile: AV:N confirms network reachability, but AC:H substantially limits exploitability because the attacker must know or successfully enumerate a valid victim conversationId - a non-trivial prerequisite. PR:L confirms authentication is required, eliminating unauthenticated exploitation. Impact is bounded to VC:L (limited confidentiality of conversation data); no integrity (VI:N) or availability (VA:N) consequences are present, and no scope change affects subsequent systems (SC/SI/SA all N). The E:P modifier confirms POC availability, elevating urgency slightly above a purely theoretical flaw. CISA KEV absence and no EPSS data in the provided input mean confirmed widespread exploitation is not documented; the low CVSS score and niche product footprint further reduce systemic risk. EPSS score is not provided - exploitation probability cannot be quantified from available data. The most meaningful real-world risk is in SaaS or shared VoltAgent deployments where multiple users' sensitive AI conversation histories are co-resident, making insider-threat or multi-tenant abuse scenarios the primary concern.

An authenticated VoltAgent user enumerates or guesses a victim user's conversationId - feasible if IDs follow a predictable format or can be leaked through other API responses - then issues a GET request to the Memory REST API substituting the victim's conversationId, bypassing the missing ownership check in handleGetMemoryConversation and receiving the victim's private AI conversation history in the response. A proof-of-concept demonstrating this cross-user data access is publicly available at https://github.com/VoltAgent/voltagent/issues/1315, lowering the barrier to exploitation for authenticated users.