Cinnamon AI’s Kotaemon (all versions up to 0.12.0) includes four chat handler methods that load a Conversation record by its ID without verifying the requester's user_id against the conversation’s owner. This flaw allows any authenticated user to read other users’ chat transcripts, RAG retrieval history, AI‑generated plots, and chat suggestions, as well as permanently delete, rename, or overwrite another user’s conversation and its suggestion list. The result is a breach of confidentiality, potential disruption of user experience, and alteration of data integrity.

Cinnamon AI: Kotaemon versions through and including v0.12.0 are affected.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting limited evidence of current exploitation. However, the vulnerability is exploitable by any authenticated user without additional prerequisites, which makes it trivial to abuse once access is gained. The lack of access controls creates a high risk of data leakage and modification for all users. Security teams should treat this flaw as a significant threat until a fix is deployed.