VU#754548: Cinnamon's kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers
Kotaemon through v0.12.0 lets any logged-in user read or alter others' chats and document excerpts via CVE-2026-86867.
CERT/CC VU#754548 describes CVE-2026-86867 in Cinnamon's Kotaemon RAG chatbot, affecting every version through v0.12.0. The select_conv, delete_conv, rename_conv, and persist_chat_suggestions handlers query conversations by ID without checking the owner, so any authenticated user who knows a UUID can read transcripts and verbatim document excerpts, delete or rename chats, or overwrite suggestions. The vendor could not be reached, and no official patch is available. Injected suggestions are described as a possible prompt-injection path if the model acts on them.
- Broken ownership checks affect four chat handlers through v0.12.0.
- RAG history can expose verbatim excerpts from private documents.
- Any authenticated user with a conversation UUID can act.
- No official patch exists; overwritten suggestions may seed prompt injection.
- Conversation deletion is permanent and has no recycle bin.
- CVEs
- CVE-2026-86867
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86867 | Broken Access Control in Cinnamon Kotaemon Chat Lets Users Read and Delete Others' Chats | 6.5 | — |
From the original article
2 min read at kb.cert.orgOverview Cinnamon's Kotaemon (all versions up to v0. 12. 0) multi‑user chat interface does not verify conversation ownership when loading a conversation.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.