VU#754548: Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

T1Covered by 1 source · first reported by CERT/CC at 23 Sept, 17:41 UTC

Overview Cinnamon's Kotaemon (all versions up to v0.12.0) multi‑user chat interface does not verify conversation ownership when loading a conversation. Any authenticated user can read, delete, rename, or overwrite another user’s conversation data by supplying the correct ID. This results in…

security

Sources

• T1VU#754548: Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlersCERT/CC23 Sept, 17:41