IDOR flaw in Kotaemon exposes private RAG chats
Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Cinnamon's Kotaemon (≤v0.12.0) fails to verify conversation ownership, letting any authenticated user read, delete, rename, or overwrite other users' chat and document data.
CERT/CC has published VU#754548 detailing an insecure direct object reference (IDOR) vulnerability in Kotaemon, an open-source retrieval-augmented generation (RAG) chatbot tool from Cinnamon. All versions up to and including v0.12.0 fail to verify that a requesting user owns a given conversation before performing operations on it. Four handlers—select_conv, delete_conv, rename_conv, and persist_chat_suggestions—query conversations solely by ID without checking the Conversation.user field, meaning any authenticated user who obtains a conversation UUID can read, delete, rename, or overwrite another user's data.
The impact is significant for Kotaemon's typical enterprise use case of document Q&A over proprietary knowledge bases. The select_conv handler returns full chat transcripts and RAG retrieval history unconditionally, and retrieval_history contains verbatim excerpts from indexed private documents (legal briefs, financial reports, internal strategy docs), meaning an attacker can exfiltrate sensitive document content without needing separate file-read permissions. UUIDs can be harvested from the global conversation browser when conversations are public, and remain valid even if the conversation is later made private. delete_conv permits irreversible destruction of any conversation (no soft-delete/recycle bin exists), enabling mass deletion of a target's or all users' conversation history. persist_chat_suggestions can be abused to inject attacker-controlled prompt suggestions into a victim's UI, a potential prompt-injection vector if the underlying model acts on suggested prompts.
No authentication bypass or privilege escalation is required—only a valid authenticated account on the instance. CERT/CC states the vendor could not be reached to coordinate disclosure, and no official patch is currently available. Defenders running Kotaemon in multi-user mode should monitor for anomalous cross-user access patterns to conversation endpoints, restrict access to trusted users only, and watch the vendor's GitHub repository for a fix. There is no indication of in-the-wild exploitation at this time.
Mentioned in this report
Detection guidance
Kotaemon Conversation Enumeration via Authenticated Access
Detects repeated HTTP requests to Kotaemon select_conv handler by authenticated user accessing conversations owned by different users, indicative of IDOR enumeration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kotaemon Conversation Enumeration via Authenticated Access
description: Detects anomalous patterns of authenticated HTTP requests to Kotaemon's
select_conv endpoint with varying conversation UUIDs, suggesting IDOR-based conversation
enumeration across multiple users' data.
tags:
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection:
http_method: GET
url|contains: select_conv
http_status: 200
filter_single_conversation:
url|re: select_conv[?&]conv_id=([a-f0-9\-]{36})
condition: selection and not filter_single_conversation
falsepositives:
- Legitimate users browsing multiple conversations sequentially
- Automated backups or export tools accessing conversation history
level: medium
id: 72d21bc5-b21c-53d6-bfb7-2e7256595265
status: experimental
author: Vorant
Kotaemon Bulk Conversation Deletion
Detects multiple rapid HTTP DELETE requests to Kotaemon delete_conv handler targeting different conversation IDs within a short time window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kotaemon Bulk Conversation Deletion
description: Detects rapid successive HTTP DELETE requests to Kotaemon's delete_conv
endpoint with multiple unique conversation UUIDs, indicative of IDOR-driven mass
deletion attack. Rule triggers when 5+ distinct conversation deletions occur from
the same authenticated user within 5 minutes.
tags:
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection:
http_method: DELETE
url|contains: delete_conv
http_status:
- 200
- 204
condition: selection
falsepositives:
- Legitimate user performing account cleanup or archival in bulk
- Administrative tools performing scheduled data retention purges
level: high
id: f4af6d97-e008-57e1-8523-dbc29b602bc5
status: experimental
author: Vorant
Kotaemon Conversation Rename Across User Boundaries
Detects HTTP POST/PUT requests to Kotaemon rename_conv handler modifying conversations with evidence of cross-user access via IDOR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kotaemon Conversation Rename Across User Boundaries
description: Detects HTTP requests to Kotaemon's rename_conv endpoint where authenticated
user modifies conversation metadata for conversations they do not own, exploiting
IDOR to alter or exfiltrate conversation identifiers.
tags:
- attack.t1552
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection:
http_method:
- POST
- PUT
url|contains: rename_conv
http_status: 200
filter_self_rename:
url|re: rename_conv.*user_id=([a-f0-9\-]{36}).*conv_id=\1
condition: selection and not filter_self_rename
falsepositives:
- Shared workspace tools permitting collaborative conversation management
- Administrative bulk rename operations with proper authorization
level: medium
id: 142c79d8-7da4-5433-9223-bce11c9bbd74
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/754548
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections with the Splunk SPL and Microsoft KQL already written, the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 9,539 reports from 155 sources, 1,375 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs