A critical authorization bypass vulnerability in Kotaemon allows unauthorized actors to access and manipulate the private chat histories of other users.

The application fails to perform proper ownership validation in the select_conv, delete_conv, rename_conv, and on_set_public_conversation functions within control.py. This allows an attacker to supply arbitrary conversation identifiers to execute administrative actions without requiring valid authentication or ownership of the target data.

This flaw poses a significant risk to data confidentiality and integrity by exposing sensitive user communications. Unauthorized access to chat histories can lead to the compromise of proprietary information, personal data, or internal discussions, resulting in severe reputational damage and potential regulatory non-compliance. Given the CVSS score of 7.4, this vulnerability is categorized as high severity and requires immediate remediation to prevent data exfiltration.

Immediate Action: Update the Kotaemon installation to the latest version that includes the fix for this authorization logic error.

Proactive Monitoring: Review application access logs for unusual patterns, such as sequential requests to conversation identifiers that do not belong to the active user session.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing suspicious or out-of-range conversation identifiers, although this should be considered a temporary measure pending a permanent patch.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates an immediate audit of your Kotaemon deployment. Because this flaw enables direct access to private user data without authentication, administrators must prioritize applying the vendor-provided updates. Failure to remediate this issue exposes your organization to significant privacy risks and unauthorized data manipulation.