Quivr CVE-2026-82280

Exploitation requires a valid authenticated Quivr account (PR:L per CVSS 4.0 vector - unauthenticated access is insufficient). The attacker must hold at least read-only membership in a shared brain, which is sufficient to expose prompt identifiers through normal API responses. No non-default configuration, elevated privileges beyond a basic session, or special platform version is required. The attack is bounded to integrity impact on prompt content; it does not grant code execution or direct access to underlying infrastructure. Exploitation is further limited to brains that have been shared with the attacker's account - isolated private brains with no external members are not reachable. No victim interaction is required once the attacker possesses the prompt identifier.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation requiring only low-privileged authentication, no special attack conditions, and no victim interaction - a low barrier for any authenticated insider or compromised account. The VI:H rating reflects the full integrity impact on system prompts that control AI brain behavior, while VC:L acknowledges that prompt identifiers are exposed to read-only users as part of normal API operation. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified numerically; this is a data gap that defenders should note. There is no CISA KEV listing, so active exploitation is not confirmed. Despite the absence of a known exploit, the practical risk is elevated in shared or multi-tenant deployments: any authenticated user granted read-only brain access can silently overwrite prompts affecting the entire user base of that brain, analogous to a supply-chain integrity attack within the application layer. This is not a high-CVSS-but-low-real-risk scenario - the attack complexity is genuinely low and the integrity consequence is immediate and broad.

An authenticated attacker with read-only membership in a shared Quivr brain reads the prompt identifier from an API response during normal usage, then issues an HTTP modification request to the prompt endpoint supplying that identifier alongside arbitrary replacement content. Since the server performs no ownership check, the request succeeds and the system prompt is overwritten, altering AI brain behavior - potentially injecting adversarial instructions or censoring outputs - for every user of the shared brain. No public exploit code is confirmed, but the attack requires only a standard HTTP client and knowledge of the API structure.