Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chatid}/history, DELETE /chat/{chatid}, and POST /chat/{chatid}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.