R2R, a conversational AI platform released by SciPhi‑AI, was found to lack proper validation of user ownership when handling conversation updates and message additions. This authorization flaw permits any authenticated user to supply a conversation identifier and perform operations such as renaming or appending messages to a conversation that belongs to another user. Attackers can therefore corrupt the conversation state and inject malicious content into other users' chat histories. The weakness corresponds to CWE‑639, an authorization bypass through user‑controlled keys.

The flaw exists in all R2R releases up to version 3.6.5 inclusive. SciPhi‑AI is the vendor and R2R is the product. The affected installations are those that have not yet been upgraded to a version that includes the ownership validation fix.

Because the vulnerability can be exercised by any authenticated user, the attack surface is essentially all legitimate users of the platform. The exploit requires no special privileges beyond authentication and relies on supplying arbitrary conversation identifiers to the update endpoints. The CVSS score of 7.1 classifies it as High severity; the EPSS score is not available, and it has not yet been listed in the CISA KEV catalog. Given the straightforward nature of the attack, the risk is significant for organizations that rely on R2R to store sensitive or confidential conversation data.