Cinnamon's Kotaemon (all versions up to v0.12.0) fails to verify conversation ownership in its multi-user chat interface. The affected handlers (select_conv, delete_conv, rename_conv, persist_chat_suggestions) query conversations by ID without ensuring the conversation belongs to the requesting user. This allows any authenticated user to read full chat transcripts, retrieval histories containing verbatim excerpts from private documents, rename conversations, overwrite chat suggestions, or delete conversations permanently. Conversation UUIDs are exposed via the global conversation browser and remain valid even if conversations are later set to private. The persist_chat_suggestions handler can be abused to inject attacker-controlled prompts, potentially influencing the AI model. There is no recycle bin or soft-delete, so deletions are permanent. The vulnerability is an IDOR (Insecure Direct Object Reference) affecting confidentiality, integrity, and availability.

The vulnerability allows disclosure of full chat transcripts and retrieval histories containing sensitive document excerpts, violating confidentiality. Attackers can permanently delete any conversation, impacting availability. Integrity is compromised by renaming conversations and injecting attacker-controlled prompt suggestions, which may influence AI behavior. No elevated privileges are required; any authenticated user can exploit this. The exposure of UUIDs through public conversation listings facilitates exploitation. The lack of soft-delete means deleted conversations cannot be recovered. This is particularly impactful in enterprise environments where proprietary documents are indexed and queried.

No official patch or fix is currently available as the vendor could not be reached for coordination. Users should monitor the vendor's GitHub repository and official website for future updates and patches. Until a fix is released, restrict authenticated user access to trusted parties only and consider additional access controls or network segmentation to limit exposure. Review and audit conversation UUID exposure in public listings to reduce risk. Avoid using Kotaemon in multi-user mode in sensitive environments until the issue is resolved.