Kotaemon Chat History Exposure via Insecure Direct Object Reference

Executive Summary

CVE-2026-82281 is an Insecure Direct Object Reference (IDOR) vulnerability in Kotaemon, a Gradio-based multi-user chat application. It allows attackers to read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks. The flaw exists in functions like select_conv, delete_conv, rename_conv, and on_set_public_conversation in control.py due to missing ownership validation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Kotaemon is running and exposed to the network. Look for unauthorized access to conversation IDs in logs. Verify if the vulnerable functions (select_conv, delete_conv, rename_conv) lack proper authorization checks. Test by attempting to access conversations using arbitrary IDs via HTTP requests to endpoints like queue/join.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can expose sensitive information stored in chat conversations to unauthorized users. Attackers can read private chats, delete conversations, or rename them, leading to data breaches, loss of critical information, or disruption of service. Exploitation requires knowledge of a valid conversation ID, which can be obtained through default admin credentials or URL observation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA by exposing sensitive personal or health data stored in chat conversations. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach due to this flaw could result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Kotaemon to a patched version beyond 0.12.0. If an update is unavailable, restrict access to the vulnerable API endpoints (e.g., queue/join) via network policies or firewall rules. Implement strict authorization checks in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions. Disable default admin credentials and enforce strong authentication.

Useful 0 Not Useful 0