What happened
NVD published CVE-2026-86867 on 2026-09-23 (CERT/CC VU#754548): Kotaemon <= v0.12.0 chat control.py fails to verify conversation ownership on multiple handlers, loading records by user-supplied ID and allowing arbitrary read/delete/rename of other users' RAG conversations. It matches the previously-published sibling CVE-2026-82281 (same code path, CVSS 9.1/7.4) that has public PoC material and CISA SSVC 'poc' exploitation marking.
Why it matters
Kotaemon is a popular self-hosted RAG/Chat-with-your-documents tool; the flaw leaks and mutates the actual RAG chat corpora and conversations of other tenants/users — the sensitive data that is the whole point of the deployment — and deleting/toggling public status of conversations is an integrity failure on top of the confidentiality leak.
Attack vector
Four handler methods (select_conv, delete_conv, rename_conv, on_set_public_conversation among them) load a Conversation record by caller-supplied ID without verifying ownership against the authenticated user, so a session holder can read, rename, delete, or toggle visibility of another user's chat history, including conversations that contain sensitive documents/RAG context.
Affected systems
Cinnamon Kotaemon ≤ v0.12.0 (libs/ktem/ktem/pages/chat/control.py)
Mitigation
Upgrade Kotaemon to a fixed release once Cinnamon ships the ownership checks (tracked in the repo); interim, put the chat application behind a proxy that enforces per-user authorization, close open deployments, and monitor for unexpected conversation delete/rename activity (CERT/KB VU#754548).