# CVE-2026-86867: Cinnamon Kotaemon authorization bypass in chat handlers

Source: https://junglewise.ai/threats/cve-2026-86867-cinnamon-s-kotaemon-all-versions-up-to-and-including-v0-12-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86867 · Severity: medium · CVSS 6.5 · Published 2026-09-23

Cinnamon Kotaemo is an open-source chatbot tool that indexes private documents for question-answering in multi-user environments. Any authenticated user can bypass ownership checks to read other users' chat transcripts and document excerpts, delete conversations permanently, rename conversations, or inject malicious prompt suggestions. An attacker needs only a valid account and a victim's conversation ID, which may be exposed through the public conversation browser.

Technologies: [Cinnamon Kotaemon](https://junglewise.ai/threats/technologies/kotaemon). Vendors: [Cinnamon](https://junglewise.ai/threats/vendors/cinnamon).

## Quick answers

**Is CVE-2026-86867 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86867 being exploited in the wild.

**How severe is CVE-2026-86867?** Medium severity, with a CVSS score of 6.5, published 23 September 2026.

**Which products and versions are affected?** Cinnamon Kotaemon up to and including v0.12.0.

**Is there a fix for CVE-2026-86867?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86867 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86867?** Check whether you run Cinnamon Kotaemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Four handler methods in libs/ktem/ktem/pages/chat/control.py (select_conv, delete_conv, rename_conv, persist_chat_suggestions) load Conversation records by ID without verifying the Conversation.user field matches the authenticated user_id. This is an Insecure Direct Object Reference (IDOR) vulnerability. Any authenticated user can read sensitive data including RAG retrieval history containing verbatim document excerpts, permanently delete conversations, modify conversation names, or overwrite suggestion lists. The attack requires network access, authentication, and knowledge of target conversation UUIDs.

## Affected products

- Cinnamon Kotaemon up to and including v0.12.0

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: advisory

## References

- [https://kb.cert.org/vuls/id/754548](https://kb.cert.org/vuls/id/754548)
- [https://www.kb.cert.org/vuls/id/754548](https://www.kb.cert.org/vuls/id/754548)

## Related threats

- [kotaemon insecure deserialization in check_connection endpoint](https://junglewise.ai/threats/cve-2026-69098-kotaemon-insecure-deserialization-in-check-connection-endpoint)
- [Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.](https://junglewise.ai/threats/cve-2025-56527-plaintext-password-storage-in-kotaemon-0-11-0-in-the-client-s)
- [Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.](https://junglewise.ai/threats/cve-2025-56526-cross-site-scripting-xss-vulnerability-in-kotaemon-0-11-0)