VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users'… (CVE-2026-82283)

CVE-2026-82283 describes a security vulnerability in VoltAgent up to version 2.1.20. The issue arises from a failure to validate conversation ownership within memory API handlers. Authenticated users can exploit this to access arbitrary conversations and messages by supplying identifiers they control, leading to unauthorized read, modification, and deletion of data. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and high confidentiality and integrity impacts but no availability impact.

An attacker with valid authentication can bypass authorization checks to access and manipulate conversations and messages of other users. This compromises confidentiality and integrity of user data but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious activity related to conversation access. Avoid exposing memory API handlers to untrusted authenticated users.