Description
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Cinnamon kotaemon
Default version status: unaffected
0 to ≤ 0.12.0affected
References
- https://github.com/Cinnamon/kotaemon/issues/846 ↗
- https://github.com/Cinnamon/kotaemon ↗
- https://github.com/Cinnamon/kotaemon/blob/9ad3e4e49aa35b8acddd235918a5d9753c1cfdf9/libs/ktem/ktem/pages/chat/control.py ↗
- https://www.vulncheck.com/advisories/kotaemon-missing-ownership-check-in-conversation-functions ↗