Kotaemon through version 0.12.0 contains a missing authorization vulnerability in control.py affecting four functions: select_conv, delete_conv, rename_conv, and on_set_public_conversation. The flaw allows attackers to supply arbitrary conversation identifiers without proper ownership validation. As a result, malicious users can read other users' private chat histories, delete their conversations, or rename them. This constitutes a broken access control issue exposing sensitive user data and enabling destructive actions. The vulnerability is documented in the NVD and has an associated GitHub issue report. No authentication bypass is required beyond having an account and knowing or guessing conversation IDs. Affected deployments include all Kotaemon instances running version 0.12.0 and earlier. Users are advised to review the referenced advisory and apply any available patches or mitigations promptly.
