CVE-2026-82283

HighCVSS 8.1

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints.

Risk Assessment

The risk includes user privacy breach, unauthorized modification or deletion of data, potentially leading to data integrity loss and trust erosion.

Recommendation

Update VoltAgent to a patched version and implement ownership validation in the API. Also restrict access to sensitive endpoints.

Other vulnerabilities in VoltAgent

CVE-2026-13511Low
A vulnerability was found in VoltAgent up to version 2.1.17 in the Memory REST API component. The function handleGetMemoryConversation in memory.handlers.ts improperly authorizes access after manipulation of the conversationId argument. The attack can be performed remotely but is difficult to exploit due to high complexity.

Original NVD description (English source)