CVE-2026-82281: Authorization Bypass Through User-Controlled Key in Cinnamon kotaemon

The vulnerability in Cinnamon kotaemon (up to 0.12.0) arises from improper validation of conversation ownership in the select_conv, delete_conv, rename_conv, and on_set_public_conversation functions within control.py. Attackers can exploit this by providing arbitrary conversation IDs, bypassing authorization checks and gaining unauthorized access to read, delete, or rename conversations belonging to other users. This represents an authorization bypass due to user-controlled keys without proper ownership verification.

An attacker without privileges can read other users' private chat histories, delete conversations, or rename conversations. This compromises confidentiality and integrity of user data within the affected application. The CVSS 4.0 score of 9.1 reflects the critical nature of this vulnerability with network attack vector, high complexity, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, users should consider restricting access or monitoring usage of the affected functions if possible.