CVE-2026-13508

Received Received - Intake

Authorization Bypass in khoj AI Chat API

Publication date: 2026-06-28

Last updated on: 2026-06-28

Assigner: VulDB

Description

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-28

Last Modified

2026-06-28

Generated

2026-06-29

AI Q&A

2026-06-29

EPSS Evaluated

N/A

NVD

CVE-2026-13508

EUVD

EUVD-2026-40005

Affected Vendors & Products

Vendor	Product	Version / Range
khoj-ai	khoj	to 2.0.0-beta.28 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in the khoj-ai khoj software up to version 2.0.0-beta.28, specifically in the Conversation Sharing Handler component located in the file src/khoj/routers/api_chat.py. The issue arises from manipulation of the argument conversation.agent, which leads to incorrect authorization. This means that an attacker could potentially exploit this flaw remotely to bypass authorization controls.

The exploit for this vulnerability has been published and is available for use, although a fix has been proposed and is awaiting acceptance.

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to manipulate authorization checks within the khoj-ai khoj application. This could lead to unauthorized access or actions within the system, potentially exposing sensitive information or allowing unintended operations.

Hi! I’m here to help you understand CVE-2026-13508. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70