---
id: CVE-2026-82283
title: >-
  VoltAgent through 2.1.20 fails to validate conversation ownership in memory
  API handlers, allowing authenticated users to access other users'
  conversations
summary: >-
  VoltAgent through 2.1.20 fails to validate conversation ownership in memory
  API handlers, allowing authenticated users to access other users'
  conversations. Attackers can read, modify, and delete arbitrary conversations
  and messages by s…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
published: '2026-08-28'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:46.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82283'
references:
  - url: 'https://github.com/VoltAgent/voltagent'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/VoltAgent/voltagent/blob/44b4c8e4998ce56095b2f0e4eaf1a988f5e6d0de/packages/server-core/src/handlers/memory.handlers.ts
    label: disclosure@vulncheck.com
  - url: 'https://github.com/VoltAgent/voltagent/issues/1371'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/voltagent-memory-api-handlers-missing-ownership-checks
    label: disclosure@vulncheck.com
  - url: 'https://github.com/VoltAgent/voltagent/issues/1371'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00303
epssPercentile: 0.20434
ingestedAt: '2026-09-23T17:28:14.816Z'
vendor: VoltAgent
product: '@voltagent/server-core'
affected:
  - '@voltagent/server-core <= 2.1.20'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-28T20:26:43.814748Z'
---

## Overview

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.