Cinnamon's Kotaemon, a RAG-based chatbot tool, suffers from a critical security flaw allowing unauthorized access to user conversations. Versions up to v0.12.0 fail to verify conversation ownership before loading or modifying them. Any authenticated user can exploit this by simply knowing another user's conversation ID. This allows them to read, delete, rename, or overwrite any conversation.The vulnerability affects four handlers: select_conv, delete_conv, rename_conv, and persist_chat_suggestions. Without proper authorization checks, these handlers operate on conversations irrespective of ownership. The select_conv handler can expose full chat transcripts and sensitive retrieval history containing excerpts from private documents. Delete_conv allows for permanent deletion of any conversation, with no recovery option.Rename_conv permits renaming conversations, while persist_chat_suggestions can be used to inject malicious prompt suggestions. The disclosure of retrieval history is particularly concerning for enterprise use cases involving proprietary data. Attackers can gain access to sensitive document content without needing direct file-read permissions. Since public conversations display their UUIDs, even private conversations are at risk. No elevated privileges are needed to exploit this vulnerability, only an authenticated account. A solution is not yet available as the vendor could not be reached.