{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/754548#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nCinnamon's Kotaemon (all versions up to v0.12.0) multi‑user chat interface does not verify conversation ownership when loading a conversation. Any authenticated user can read, delete, rename, or overwrite another user’s conversation data by supplying the correct ID. This results in high‑impact confidentiality, integrity, and availability violations.\r\n\r\n### Description\r\nCinnamon's Kotaemon is an open‑source, retrieval‑augmented generation (RAG) based tool that lets you build a chatbot capable of \"chatting with your documents\". As discussed in **CVE-2026-86867**, all versions up to v0.12.0 fail to verify conversation ownership when loading a conversation. In multi‑user mode, each conversation row includes a user field that identifies its owner. The four affected handlers, `select_conv, delete_conv, rename_conv, and persist_chat_suggestions`, query conversations using `select(Conversation).where(Conversation.id == conversation_id)`\r\n\r\nNo predicate is included to ensure `Conversation.user == user_id`. As a result, any authenticated user can operate on conversations they do not own. \r\n\r\nImpacted operations include:\r\n* `select_conv` – reads the full chat transcript, RAG retrieval history (verbatim excerpts from uploaded private documents), plot history, and suggestion data belonging to another user.\r\n* `delete_conv` – permanently deletes a conversation.\r\n* `rename_conv` – renames a conversation.\r\n* `persist_chat_suggestions` – overwrites a chat suggestion list.\r\n\r\nAlthough `select_conv` includes an ownership check for the selected (file‑picker) field, all sensitive payloads (chat history, retrieval history, plot history) are returned unconditionally. The system trusts user‑controlled identifiers for authorization. Attackers require only an authenticated account on the instance and a victim conversation UUID (Universally Unique Identifier). Affected users’ public conversations appear in the global conversation browser, exposing their UUIDs. If a conversation is later set to private, the UUID remains unchanged and still valid. Similar direct calls to `delete_conv, rename_conv, and persist_chat_suggestions` allow deletion, renaming, or content overwriting. No elevated privileges are required; any authenticated user account is sufficient.\r\n\r\n### Impact\r\nFull chat transcripts and RAG retrieval history for any conversation are disclosed. For Kotaemon's primary deployment use case (enterprise document Q&A over proprietary knowledge bases such as legal briefs, financial reports, research papers, and internal strategy documents), the `retrieval_history` field contains verbatim excerpts from those private documents. A single IDOR (Insecure Direct Object Reference) read may expose more sensitive content than what the affected user intended to share with any other party.\r\n\r\nConversations can be renamed or have their suggestion state overwritten. While the impact of renaming is limited, the `persist_chat_suggestions` path allows an attacker to inject attacker-controlled prompt suggestions into the victim's conversation UI, a potential vector for prompt injection if the AI model acts on suggested prompts.\r\n\r\n`delete_conv` permanently destroys any conversation with a single call. An attacker can systematically delete all conversations of a target user or across all users if they have access to the UUIDs. There is no recycle bin or soft-delete in the Kotaemon data model for conversations.\r\n\r\nBecause `retrieval_history` contains verbatim document chunks (not just file names), the attacker does not need separate file-read permissions to access the content of documents indexed into the victim's knowledge base. The chat conversation becomes a side-channel through which document content leaks.\r\n\r\n### Solution\r\nUnfortunately, the vendor could not be reached to coordinate this vulnerability. While an official patch is not available at this time, please refer to the vendor's web site and GitHub repository (listed in the references below) for future updates. \r\n[https://github.com/Cinnamon/kotaemon](https://github.com/Cinnamon/kotaemon)\r\n[https://cinnamon.github.io/kotaemon/](https://cinnamon.github.io/kotaemon/)\r\n\r\n### Acknowledgements\r\nThank you to Louis Sanchez for reporting this vulnerability. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/754548"},{"url":"https://github.com/Cinnamon/kotaemon","summary":"https://github.com/Cinnamon/kotaemon"},{"url":"https://cinnamon.github.io/kotaemon/","summary":"https://cinnamon.github.io/kotaemon/"}],"title":"Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers","tracking":{"current_release_date":"2026-09-23T19:24:58+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.49"}},"id":"VU#754548","initial_release_date":"2026-09-23 17:41:05.165494+00:00","revision_history":[{"date":"2026-09-23T19:24:58+00:00","number":"1.20260923192458.2","summary":"Released on 2026-09-23T19:24:58+00:00"}],"status":"final","version":"1.20260923192458.2"}},"vulnerabilities":[{"title":"Cinnamon's Kotaemon (all versions up to and including v0.","notes":[{"category":"summary","text":"Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester's `user_id` to the conversation's owner `Conversation.user`. This allows any authenticated user to perform the following actions:\r\n1. Read other user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions.\r\n2. Permanently delete another user's conversation.\r\n3. Rename another user's conversation.\r\n4. Overwrite another user's conversation's chat suggestion list."}],"cve":"CVE-2026-86867","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#754548"}]}],"product_tree":{"branches":[]}}