Broken Access Control in Cinnamon Kotaemon Chat Lets Users Read and Delete Others' Chats
AI analysis
Cinnamon's Kotaemon, an open-source RAG/chat interface, fails to enforce per-user ownership checks in four handler methods in libs/ktem/ktem/pages/chat/control.py, which load a Conversation record by its ID without comparing the requester's user_id to the conversation's owner (Conversation.user). Any authenticated user can trigger the flaw by supplying another user's conversation ID in a request, allowing them to read that user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions. An attacker can also permanently delete another user's conversation, rename it, or overwrite its chat suggestion list, with no indication that deleted data is recoverable. All versions up to and including v0.12.0 are affected wherever multi-user mode is enabled, especially deployments that grant accounts to users who should not see each other's work. There is no public proof of concept, no known exploitation, no CISA KEV entry, and no CVSS score assigned yet.
What to do: Watch for and upgrade to a release newer than v0.12.0 once Cinnamon ships a fix that adds user_id-vs-owner checks to the four affected handlers in libs/ktem/ktem/pages/chat/control.py; no fixed version is confirmed at this time. Until patched, do not expose multi-user Kotaemon instances to untrusted users or the public internet — restrict access to trusted accounts behind a VPN or SSO, and consider reviewing those handlers to reject requests where the requester's user_id does not match Conversation.user. Audit conversations and logs for cross-user reads, renames, deletions, or overwritten suggestion lists, and notify users whose transcripts may have been exposed, since chats and RAG history can reveal sensitive retrieved document content.
Affected
| Cinnamon Kotaemon | all versions up to and including v0.12.0 |
Estimated exposure
nicheLikely on the order of a few thousand self-hosted instances, only a subset running multi-user mode — Kotaemon is a self-hosted open-source RAG UI with no active-install telemetry, and deployments are typically internal enterprise or lab setups rather than large public services, so only a small fraction of instances are internet-exposed…
Description
Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester's `user_id` to the conversation's owner `Conversation.user`. This allows any authenticated user to perform the following actions: 1. Read other user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions. 2. Permanently delete another user's conversation. 3. Rename another user's conversation. 4. Overwrite another user's conversation's chat suggestion list.