CVE-2026-13508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13508
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13508.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13508
Published
2026-06-28T21:45:10.327Z
Modified
2026-07-15T01:48:49.843334692Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
khoj-ai khoj Conversation Sharing api_chat.py authorization
Details

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-285",
        "CWE-863"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.0.0-beta.0"
                },
                {
                    "last_affected": "2.0.0-beta.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13508.json"
}
References

Affected packages

Git / github.com/khoj-ai/khoj

Affected ranges

Type
GIT
Repo
https://github.com/khoj-ai/khoj
Events
Introduced
8cd2a1a96174c171e0080be4234b2b6147c3517c
Last affected
9258f57dceab19d52a1a0bdac54eb38576c29187
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0.0-beta.1"
        },
        {
            "last_affected": "2.0.0-beta.1"
        },
        {
            "introduced": "2.0.0-beta.2"
        },
        {
            "last_affected": "2.0.0-beta.2"
        },
        {
            "introduced": "2.0.0-beta.3"
        },
        {
            "last_affected": "2.0.0-beta.3"
        },
        {
            "introduced": "2.0.0-beta.4"
        },
        {
            "last_affected": "2.0.0-beta.4"
        },
        {
            "introduced": "2.0.0-beta.5"
        },
        {
            "last_affected": "2.0.0-beta.5"
        },
        {
            "introduced": "2.0.0-beta.6"
        },
        {
            "last_affected": "2.0.0-beta.6"
        },
        {
            "introduced": "2.0.0-beta.7"
        },
        {
            "last_affected": "2.0.0-beta.7"
        },
        {
            "introduced": "2.0.0-beta.8"
        },
        {
            "last_affected": "2.0.0-beta.8"
        },
        {
            "introduced": "2.0.0-beta.9"
        },
        {
            "last_affected": "2.0.0-beta.9"
        },
        {
            "introduced": "2.0.0-beta.10"
        },
        {
            "last_affected": "2.0.0-beta.10"
        },
        {
            "introduced": "2.0.0-beta.11"
        },
        {
            "last_affected": "2.0.0-beta.11"
        },
        {
            "introduced": "2.0.0-beta.12"
        },
        {
            "last_affected": "2.0.0-beta.12"
        },
        {
            "introduced": "2.0.0-beta.13"
        },
        {
            "last_affected": "2.0.0-beta.13"
        },
        {
            "introduced": "2.0.0-beta.14"
        },
        {
            "last_affected": "2.0.0-beta.14"
        },
        {
            "introduced": "2.0.0-beta.15"
        },
        {
            "last_affected": "2.0.0-beta.15"
        },
        {
            "introduced": "2.0.0-beta.16"
        },
        {
            "last_affected": "2.0.0-beta.16"
        },
        {
            "introduced": "2.0.0-beta.17"
        },
        {
            "last_affected": "2.0.0-beta.17"
        },
        {
            "introduced": "2.0.0-beta.18"
        },
        {
            "last_affected": "2.0.0-beta.18"
        },
        {
            "introduced": "2.0.0-beta.19"
        },
        {
            "last_affected": "2.0.0-beta.19"
        },
        {
            "introduced": "2.0.0-beta.20"
        },
        {
            "last_affected": "2.0.0-beta.20"
        },
        {
            "introduced": "2.0.0-beta.21"
        },
        {
            "last_affected": "2.0.0-beta.21"
        },
        {
            "introduced": "2.0.0-beta.22"
        },
        {
            "last_affected": "2.0.0-beta.22"
        },
        {
            "introduced": "2.0.0-beta.23"
        },
        {
            "last_affected": "2.0.0-beta.23"
        },
        {
            "introduced": "2.0.0-beta.24"
        },
        {
            "last_affected": "2.0.0-beta.24"
        },
        {
            "introduced": "2.0.0-beta.25"
        },
        {
            "last_affected": "2.0.0-beta.25"
        },
        {
            "introduced": "2.0.0-beta.26"
        },
        {
            "last_affected": "2.0.0-beta.26"
        },
        {
            "introduced": "2.0.0-beta.27"
        },
        {
            "last_affected": "2.0.0-beta.27"
        },
        {
            "introduced": "2.0.0-beta.28"
        },
        {
            "last_affected": "2.0.0-beta.28"
        }
    ]
}

Affected versions

2.*
2.0.0-beta.1
2.0.0-beta.10
2.0.0-beta.11
2.0.0-beta.12
2.0.0-beta.13
2.0.0-beta.14
2.0.0-beta.15
2.0.0-beta.16
2.0.0-beta.17
2.0.0-beta.18
2.0.0-beta.19
2.0.0-beta.2
2.0.0-beta.20
2.0.0-beta.21
2.0.0-beta.22
2.0.0-beta.23
2.0.0-beta.24
2.0.0-beta.25
2.0.0-beta.26
2.0.0-beta.27
2.0.0-beta.28
2.0.0-beta.3
2.0.0-beta.4
2.0.0-beta.5
2.0.0-beta.6
2.0.0-beta.7
2.0.0-beta.8
2.0.0-beta.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13508.json"