CyberRota Analysis
AI-GeneratedKotaemon versions up to 0.12.0 are vulnerable due to inadequate validation of conversation ownership in key functions, allowing attackers to access other users' chat histories, delete conversations, or rename them by manipulating conversation identifiers. This poses a significant risk to user privacy and data integrity. Organizations using affected versions should prioritize patching to mitigate potential unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.