CVE-2026-82281: Cinnamon Kotaemon

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.

Affected products

• Cinnamon Kotaemon: up to and including 0.12.0

Published 2026-08-28. Last modified 2026-09-23.