EUVD-2026-67812
GHSA-4qgc-qr9j-76rw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Cross-user IDOR needs an authenticated account (PR:L) and knowledge/enumeration of conversation IDs (AC:H); high confidentiality and integrity from reading and deleting/renaming others' conversations, no availability metric.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.
AnalysisAI
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a multi-user Kotaemon deployment (through 0.12.0) where the attacker has an active session and can invoke the conversation handlers in control.py. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and should temper the headline 9.1. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the affected range is open-ended ('through 0.12.0') and the references point to a tracking issue (#846) and the vulnerable file rather than a tagged fixed release, so no exact fix version can be cited. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Kotaemon deployments at version 0.12.0 or earlier and immediately restrict network access to the application, allowing only trusted administrators to connect; export and back up conversation data for forensic analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary c
An issue was discovered in Cinnamon kotaemon 0.11.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely ex
Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. Rated high severity (CVSS 7.5), this vulnera
Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted P
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today