CVE-2026-86867

Cinnamon&amp;#39;s Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester&amp;#39;s `user_id` to the conversation&amp;#39;s owner `Conversation.user`. This allows any authenticated user to perform the following actions:<br /> 1. Read other user&amp;#39;s chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions.<br /> 2. Permanently delete another user&amp;#39;s conversation.<br /> 3. Rename another user&amp;#39;s conversation.<br /> 4. Overwrite another user&amp;#39;s conversation&amp;#39;s chat suggestion list.