EUVD-2026-67814
GHSA-ch6f-pcf5-xp4j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid VoltAgent account
-
DeliveryAuthenticate to memory API
-
ExploitSubmit request with foreign conversation ID
-
ExecutionServer skips ownership validation
-
ImpactRead or overwrite victim conversation data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | The attacker must possess a valid authenticated session on the target VoltAgent instance, corresponding to PR:L in the CVSS 4.0 vector. Exploitation is limited exclusively to authenticated users - unauthenticated external actors cannot exploit this vulnerability without first obtaining credentials. No special server configuration is required; the flaw is present in default multi-user deployments of VoltAgent through 2.1.20. The attack targets any memory API endpoint that accepts a conversation or message identifier as a caller-supplied parameter. The limiting factor is authentication: single-tenant deployments or deployments restricted to fully trusted users have no realistic attack surface. |
| Impact | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects the real-world risk profile: the attack is network-accessible, requires no special conditions, demands only a low-privilege authenticated account, and yields high confidentiality and integrity impact. The attack is fully automatable - an adversary with any valid account can enumerate or brute-force conversation IDs at scale. No CISA KEV listing and no confirmed POC exploit code exist at time of analysis; however, the IDOR class is extremely well-understood and requires no specialized tooling, making the effective exploitation barrier very low. The absence of availability impact (VA:N) is consistent with the read/write nature of the flaw. The primary risk is data exposure and data tampering across all platform users in shared deployments - a significant concern for SaaS or multi-tenant VoltAgent instances. |
| Exploit ScenarioDerived | An attacker registers or obtains any valid VoltAgent account on a shared instance and issues authenticated requests to the memory API endpoints, substituting enumerated or guessed conversation identifiers in place of their own. Because the server performs no ownership check, it returns or mutates conversations belonging to other users, exposing conversation history, injected prompt data, or sensitive user context. The low complexity and no attack-requirement conditions in the CVSS 4.0 vector confirm this can be scripted to exfiltrate all accessible conversations at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Insecure Direct Object Reference in VoltAgent through 2.1.20 allows any authenticated user to read, modify, or delete conversations belonging to other users by supplying arbitrary conversation identifiers to memory API endpoints. The server accepts caller-controlled identifiers without verifying ownership, enabling horizontal privilege escalation across all users of a shared deployment. No public exploit has been identified at time of analysis, but the IDOR pattern (CWE-639) is trivially exploitable by any account holder with basic API knowledge.
RemediationAI
Server-side ownership validation must be added to all memory API handlers to verify that the authenticated session user owns the conversation identifier before processing read, write, or delete operations. Monitor the VoltAgent repository at https://github.com/VoltAgent/voltagent and track issue https://github.com/VoltAgent/voltagent/issues/1371 for a patched release beyond 2.1.20 - no specific fixed version number is confirmed from available data. The VulnCheck advisory at https://www.vulncheck.com/advisories/voltagent-memory-api-handlers-missing-ownership-checks should be checked for updated patch status. As a compensating control, restrict VoltAgent deployments to single-tenant or fully trusted-user environments to eliminate cross-user access risk; this removes the multi-tenant attack surface but may not be feasible for SaaS deployments. Network-layer controls that limit authenticated API access will not mitigate this flaw since the vulnerability exists in authenticated authorization logic, not at the perimeter.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
VoltAgent is an AI agent orchestration framework that manages conversational memory and state via a server-core component. The flaw resides specifically in packages/server-core/src/handlers/memory.handlers.ts, where memory API handlers accept conversation identifiers directly from the requesting caller. CWE-639 (Authorization Through User-Controlled Key) is the root cause: the system trusts a user-supplied resource key for authorization rather than performing a server-side ownership check against the authenticated session. The CPE cpe:2.3:a:voltagent:voltagent:*:*:*:*:*:*:*:* confirms all VoltAgent releases through 2.1.20 are affected. This class of vulnerability is particularly impactful in multi-tenant AI agent deployments where conversations may contain sensitive prompt histories, personal data, or proprietary context.
Know when Voltagent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Low-privilege authentication required; no scope change; high C and I from arbitrary cross-user conversation read/write; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints.
Executive ViewAI
Organizations using VoltAgent through version 2.1.20 face uncontrolled lateral access to other users' conversations due to missing authorization checks, exposing sensitive communications and intellectual property across shared deployments. The vulnerability affects all authenticated users with no available patch, creating immediate compliance and breach liability. Urgent interim security controls are required to prevent data exfiltration and unauthorized modification.
No vendor-released patch identified at time of analysis. Interim mitigations: implement server-side authorization checks verifying caller ownership of requested conversation identifiers before permitting read, modify, or delete operations; deploy rate limiting on conversation API endpoints to reduce exploitation velocity; restrict conversation API access to trusted internal networks; maintain comprehensive audit logs of all conversation access attempts and modifications; deploy anomaly detection to identify suspicious cross-user access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB