Description

Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-28T20:20:19.363Z",
  "pubdate": "2026-08-28T20:20:19.363Z",
  "executiveSummary": "Kotaemon versions up to 0.12.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability resulting from insufficient server-side authorization checks.\nThe vulnerability resides within the conversation management logic, specifically in control.py, where the application fails to validate whether a requester possesses the necessary permissions to access, modify, or delete a specific conversation identifier.\nBy manipulating conversation IDs, an authenticated attacker can perform unauthorized actions on chat histories belonging to other users.\nThe impact includes the compromise of data confidentiality and integrity, as attackers can read, modify, or destroy arbitrary chat logs stored within the system.\nThe exploit does not require administrative privileges, merely a valid user account, allowing any user to target any conversation present in the database through simple identifier enumeration.\nThis represents a significant security oversight in the application's access control architecture.",
  "technicalDetails": "The vulnerability is located in control.py, where the functions select_conv, delete_conv, rename_conv, and on_set_public_conversation fail to implement strict ownership verification.\nThe root cause is a breakdown in the access control layer, where the application trusts the user-supplied conversation identifier as a primary key without cross-referencing it against the session's authenticated user ID.\nIn a secure implementation, the backend must verify that the requested conversation ID is associated with the user account currently authenticated in the session.\nInstead, the current implementation performs a direct lookup or operation based solely on the identifier provided in the request payload or query parameter, enabling horizontal privilege escalation.\nThe attack flow follows a predictable pattern: An attacker captures a valid request to manage a conversation (e.g., /delete_conv?id=123), replaces the identifier with a different, guessed, or discovered ID, and submits the request.\nSince the application does not enforce an authorization check between the requester's identity and the target record, the server executes the function—such as deleting the record or updating the visibility via on_set_public_conversation—on the victim's data.\nThis exposure allows an attacker to interact with the internal data store of any user, effectively bypassing the intended logical separation of conversation history.\nThe lack of validation extends to the renaming and retrieval functions, meaning sensitive chat contents can be exfiltrated simply by calling select_conv with a sequential ID.\nBecause these functions operate in the context of the application's control logic, the actions are performed with the permissions of the application process, making them highly effective for data exfiltration or malicious modification of chat records."
}