Quivr versions through 0.0.322 contain a critical authorization flaw in prompt endpoints that fails to validate ownership before allowing modifications. Authenticated users can modify any prompt by simply knowing its identifier, regardless of whether they own it. Attackers with read-only access to shared brains can extract exposed prompt identifiers and overwrite system prompts. This affects all users of a brain, as system prompts can be tampered with by unauthorized parties. The vulnerability is an Broken Object Level Authorization (BOLA/IDOR) issue in the backend API prompt routes. It requires only authenticated access to exploit, lowering the barrier for abuse. The flaw is documented in the prompt_routes.py controller file of the Quivr backend API. No patch details are mentioned in the article, but the issue has been reported via GitHub issues and VulnCheck advisories.
