This vulnerability enables an attacker with read-only privileges to permanently reassign ownership of another user's conversation object. The core failure is the conflation of 'resource not found' (404) and 'resource not owned' (403) in the error handling path. When the write operation doesn't independently verify ownership—relying instead on the existence check's error branch—an attacker who supplies a valid conversation identifier belonging to another user can hijack that conversation. The identifier itself is derived from user-supplied input rather than server-generated UUIDs, making valid identifiers discoverable through enumeration.
The read privilege enabling a write operation signals a fundamental misalignment between the declared permission scope and the endpoint's actual operation surface. This typically indicates either a permission mislabeling or an endpoint that evolved without a corresponding security review when reassignment functionality was added.
The permanent nature of the reassignment—with no audit trail, no recovery path, and the original owner losing access irreversibly—elevates this from a data integrity issue to a trust infrastructure failure. In agentic systems where conversation context propagates to downstream agents and gets treated as a trust signal, this flaw could enable influence over agent behavior beyond the conversation itself.
Investigate whether other endpoints share this error-handling pattern. Examine test fixtures for cross-tenant scenarios—if the test suite runs against a single user's data, this vulnerability class is invisible. Review the JSON-RPC error handling: the protocol's limited error model actively discourages the 404/403 discrimination that ownership verification requires, so ensure custom error layers exist. Verify the permission model against actual endpoint operations, not assumed functionality. The next instance of this vulnerability genotype is likely already present in any endpoint sharing the user-supplied identifier derivation pattern without independent ownership verification.