CVE-2026-82271CWE-639

CVE-2026-82271

Medium · published August 29, 2026

CVSS v3.1

6.5

EPSS

Percentile

17.9

In the wild

Unconfirmed

What it is

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users' conversation histories, corrupting state and injecting malicious content.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00268 · 17.9th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-08-29T00:20Z

References (5)

https://github.com/SciPhi-AI/R2R · [email protected]https://github.com/SciPhi-AI/R2R/blob/9c5a94d151f90876bd7eb860f300a8fd662dc481/py/core/main/api/v3/conversations_router.py · [email protected]https://github.com/SciPhi-AI/R2R/issues/2292 · [email protected]https://www.vulncheck.com/advisories/r2r-missing-ownership-check-allows-modifying-other-users-conversations · [email protected]https://github.com/SciPhi-AI/R2R/issues/2292 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

30 AUG 16:19Z
EPSS moved — → 0%
epss
28 AUG 16:18Z
R2R Missing Ownership Check Allows Modifying Other Users' Conversations
cvelistv5