CVE-2026-86867: Cinnamon Kotaemon Auth Bypass Vulnerability

CVE-2026-86867 Overview

Cinnamon's Kotaemon multi-user chat interface contains broken access control vulnerabilities affecting all versions up to and including v0.12.0. Four handler methods in libs/ktem/ktem/pages/chat/control.py load Conversation records by ID without validating ownership. The application fails to compare the requester's user_id against the Conversation.user field. Any authenticated user can access, modify, or delete conversations belonging to other users. The flaw enables cross-tenant data exposure and destructive actions within shared Kotaemon deployments.

Critical Impact
Authenticated users can read other users' chat transcripts, retrieval-augmented generation (RAG) history, and AI-generated plots, and can delete, rename, or overwrite other users' conversations.

Affected Products

Cinnamon Kotaemon (all versions up to and including v0.12.0)
Kotaemon multi-user chat interface component
libs/ktem/ktem/pages/chat/control.py handler methods

Discovery Timeline

2026-09-23 - CVE CVE-2026-86867 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86867

Vulnerability Analysis

Kotaemon is an open-source retrieval-augmented generation (RAG) chat application supporting multi-user deployments. The vulnerability resides in four handler methods within libs/ktem/ktem/pages/chat/control.py. Each handler receives a Conversation identifier and loads the corresponding record from persistent storage. The handlers do not verify that the authenticated requester matches the Conversation.user owner field. This constitutes an Insecure Direct Object Reference (IDOR) and a Broken Access Control weakness.

An authenticated attacker enumerates or guesses Conversation IDs and issues requests against the affected handlers. The server returns or modifies the target conversation without an authorization check. Impact includes disclosure of private chat transcripts, RAG retrieval history, AI-generated plots, and suggestion lists. Attackers can also permanently delete another user's conversation, rename it, or overwrite the chat suggestion list attached to it.

Root Cause

The root cause is missing authorization at the object level. The handlers rely on session authentication but omit an ownership check comparing session.user_id to Conversation.user. Access decisions defer to the presence of a Conversation ID rather than to ownership.

Attack Vector

Exploitation requires only a valid authenticated session on the Kotaemon instance. The attacker submits crafted requests referencing another user's Conversation ID to the affected read, delete, rename, or suggestion-overwrite handlers. No elevated privileges, user interaction, or specialized tooling are required. Technical details are documented in the CERT Vulnerability Advisory #754548.

Detection Methods for CVE-2026-86867

Indicators of Compromise

Application logs showing a single user_id accessing Conversation records owned by other users.
Unexpected Conversation deletions, renames, or suggestion overwrites without corresponding owner activity.
Enumeration patterns against chat handler endpoints iterating sequential Conversation IDs.
User reports of missing conversations, altered titles, or unfamiliar suggestion lists.

Detection Strategies

Instrument the four handlers in libs/ktem/ktem/pages/chat/control.py to log requester.user_id alongside Conversation.user for every access.
Alert on any request where the requesting user does not match the Conversation owner.
Baseline normal per-user Conversation access rates and flag deviations indicative of enumeration.

Monitoring Recommendations

Forward Kotaemon application and web server logs to a centralized logging platform for correlation.
Monitor authentication and session activity for accounts issuing atypical volumes of chat handler requests.
Track destructive operations (delete, rename, suggestion overwrite) and require review when performed against non-owned Conversation IDs.

How to Mitigate CVE-2026-86867

Immediate Actions Required

Restrict access to Kotaemon instances to trusted users pending a vendor fix.
Audit existing Conversation records and user activity for signs of cross-user access.
Apply an interim authorization check in the four affected handlers to compare requester.user_id against Conversation.user before processing.
Track vendor communications through the CERT Vulnerability Report #754548 for patch availability.

Patch Information

At the time of publication, no fixed release is listed in the NVD entry. Monitor the Cinnamon Kotaemon project repository and the CERT/CC advisory for updates. Upgrade to any version released after v0.12.0 that explicitly addresses the missing ownership checks in libs/ktem/ktem/pages/chat/control.py.

Workarounds

Limit Kotaemon deployments to single-tenant use until a patched release is available.
Place the application behind a reverse proxy that enforces per-user path or parameter constraints where feasible.
Disable or gate the multi-user chat interface if the deployment does not require it.
Apply a local patch adding an ownership check to each affected handler in libs/ktem/ktem/pages/chat/control.py.

bash

# Example ownership check to add in each affected handler
# if conversation.user != current_user.user_id:
#     raise HTTPException(status_code=403, detail="Forbidden")