Back to overview

CVE-2026-13511

LOW
3.1
CVSS 3.1
Description
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to improper authorization. The attack may be performed from remote. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Metadata

CVE ID
CVE-2026-13511
State
PUBLISHED
Assigner
VulDB
Reserved
2026-06-28 06:28 UTC
Published
2026-06-28 22:30 UTC
Last updated
2026-06-28 22:30 UTC
Primary CWE
CWE-285
Improper Authorization
Vendor / Product
n/a / VoltAgent
Sources
cve.org  ·  NVD

Severity & Metrics

3.1 LOW CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
Affected products (1)
VendorProductPlatformVersions
n/a VoltAgent — 2.1.0, 2.1.1, 2.1.2, 2.1.3 …
Weakness (CWE)
CWESourceDescription
CWE-266 cna Incorrect Privilege Assignment
CWE-285 cna Improper Authorization
CVSS scores (4)
ScoreSeverityVersionSourceVector
3.1 LOW 3.1 cna CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
3.1 LOW 3.0 cna CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
2.3 LOW 4.0 cna CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
2.1 N/D 2.0 cna AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
References (7)
Back to overview