IDOR flaw in Kotaemon exposes private RAG chats
Cinnamon's Kotaemon (≤v0.12.0) fails to verify conversation ownership, letting any authenticated user read, delete, rename, or overwrite other users' chat and document data.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC has published VU#754548 detailing an insecure direct object reference (IDOR) vulnerability in Kotaemon, an open-source retrieval-augmented generation (RAG) chatbot tool from Cinnamon. All versions up to and including v0.12.0 fail to verify that a requesting user owns a given conversation before performing operations on it. Four handlers—select_conv, delete_conv, rename_conv, and persist_chat_suggestions—query conversations solely by ID without checking the Conversation.user field, meaning any authenticated user who obtains a conversation UUID can read, delete, rename, or overwrite another user's data.
The impact is significant for Kotaemon's typical enterprise use case of document Q&A over proprietary knowledge bases. The select_conv handler returns full chat transcripts and RAG retrieval history unconditionally, and retrieval_history contains verbatim excerpts from indexed private documents (legal briefs, financial reports, internal strategy docs), meaning an attacker can exfiltrate sensitive document content without needing separate file-read permissions. UUIDs can be harvested from the global conversation browser when conversations are public, and remain valid even if the conversation is later made private. delete_conv permits irreversible destruction of any conversation (no soft-delete/recycle bin exists), enabling mass deletion of a target's or all users' conversation history. persist_chat_suggestions can be abused to inject attacker-controlled prompt suggestions into a victim's UI, a potential prompt-injection vector if the underlying model acts on suggested prompts.
No authentication bypass or privilege escalation is required—only a valid authenticated account on the instance. CERT/CC states the vendor could not be reached to coordinate disclosure, and no official patch is currently available. Defenders running Kotaemon in multi-user mode should monitor for anomalous cross-user access patterns to conversation endpoints, restrict access to trusted users only, and watch the vendor's GitHub repository for a fix. There is no indication of in-the-wild exploitation at this time.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/754548
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs