CVE-2026-82283
VoltAgent Memory API Handlers Missing Ownership Checks
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 28, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 28, 2026
Description
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
voltagentVoltAgent |
|
References
- GitHub Issue #1371issue-tracking
- https://github.com/VoltAgent/voltagentproduct
- Vulnerable code: memory.handlers.tstechnical-description
- VulnCheck Advisory: VoltAgent Memory API Handlers Missing Ownership Checksthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.