CVE-2026-13508 (GCVE-0-2026-13508)
Vulnerability from cvelistv5
Published
2026-06-28 21:45
Modified
2026-06-29 13:39
Severity ?
2.0 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RC:R
5.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RC:R
5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RC:R
5.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RC:R
VLAI Severity ?
EPSS score ?
Summary
A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| khoj-ai | khoj |
Version: 2.0.0-beta.0 Version: 2.0.0-beta.1 Version: 2.0.0-beta.2 Version: 2.0.0-beta.3 Version: 2.0.0-beta.4 Version: 2.0.0-beta.5 Version: 2.0.0-beta.6 Version: 2.0.0-beta.7 Version: 2.0.0-beta.8 Version: 2.0.0-beta.9 Version: 2.0.0-beta.10 Version: 2.0.0-beta.11 Version: 2.0.0-beta.12 Version: 2.0.0-beta.13 Version: 2.0.0-beta.14 Version: 2.0.0-beta.15 Version: 2.0.0-beta.16 Version: 2.0.0-beta.17 Version: 2.0.0-beta.18 Version: 2.0.0-beta.19 Version: 2.0.0-beta.20 Version: 2.0.0-beta.21 Version: 2.0.0-beta.22 Version: 2.0.0-beta.23 Version: 2.0.0-beta.24 Version: 2.0.0-beta.25 Version: 2.0.0-beta.26 Version: 2.0.0-beta.27 Version: 2.0.0-beta.28 cpe:2.3:a:khoj-ai:khoj:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13508",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T13:39:09.379215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T13:39:27.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:khoj-ai:khoj:*:*:*:*:*:*:*:*"
],
"modules": [
"Conversation Sharing Handler"
],
"product": "khoj",
"vendor": "khoj-ai",
"versions": [
{
"status": "affected",
"version": "2.0.0-beta.0"
},
{
"status": "affected",
"version": "2.0.0-beta.1"
},
{
"status": "affected",
"version": "2.0.0-beta.2"
},
{
"status": "affected",
"version": "2.0.0-beta.3"
},
{
"status": "affected",
"version": "2.0.0-beta.4"
},
{
"status": "affected",
"version": "2.0.0-beta.5"
},
{
"status": "affected",
"version": "2.0.0-beta.6"
},
{
"status": "affected",
"version": "2.0.0-beta.7"
},
{
"status": "affected",
"version": "2.0.0-beta.8"
},
{
"status": "affected",
"version": "2.0.0-beta.9"
},
{
"status": "affected",
"version": "2.0.0-beta.10"
},
{
"status": "affected",
"version": "2.0.0-beta.11"
},
{
"status": "affected",
"version": "2.0.0-beta.12"
},
{
"status": "affected",
"version": "2.0.0-beta.13"
},
{
"status": "affected",
"version": "2.0.0-beta.14"
},
{
"status": "affected",
"version": "2.0.0-beta.15"
},
{
"status": "affected",
"version": "2.0.0-beta.16"
},
{
"status": "affected",
"version": "2.0.0-beta.17"
},
{
"status": "affected",
"version": "2.0.0-beta.18"
},
{
"status": "affected",
"version": "2.0.0-beta.19"
},
{
"status": "affected",
"version": "2.0.0-beta.20"
},
{
"status": "affected",
"version": "2.0.0-beta.21"
},
{
"status": "affected",
"version": "2.0.0-beta.22"
},
{
"status": "affected",
"version": "2.0.0-beta.23"
},
{
"status": "affected",
"version": "2.0.0-beta.24"
},
{
"status": "affected",
"version": "2.0.0-beta.25"
},
{
"status": "affected",
"version": "2.0.0-beta.26"
},
{
"status": "affected",
"version": "2.0.0-beta.27"
},
{
"status": "affected",
"version": "2.0.0-beta.28"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-28T21:45:10.327Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374516 | khoj-ai khoj Conversation Sharing api_chat.py authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374516"
},
{
"name": "VDB-374516 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374516/cti"
},
{
"name": "CVE-2026-13508 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13508"
},
{
"name": "Submit #838812 | Khoj AI Khoj Source commit e8631261400e0a04c5063e91e498b549976ffc53; affected released versions are unknown. CWE-863: Incorrect Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/838812"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/khoj-ai/khoj/issues/1327"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/khoj-ai/khoj/pull/1328"
},
{
"tags": [
"product"
],
"url": "https://github.com/khoj-ai/khoj/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-28T08:26:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "khoj-ai khoj Conversation Sharing api_chat.py authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13508",
"datePublished": "2026-06-28T21:45:10.327Z",
"dateReserved": "2026-06-28T06:21:13.647Z",
"dateUpdated": "2026-06-29T13:39:27.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13508\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-29T13:39:09.379215Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-29T13:39:20.363Z\"}}], \"cna\": {\"title\": \"khoj-ai khoj Conversation Sharing api_chat.py authorization\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Dem000000 (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"VulDB CNA Team\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.1, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 6.5, \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:khoj-ai:khoj:*:*:*:*:*:*:*:*\"], \"vendor\": \"khoj-ai\", \"modules\": [\"Conversation Sharing Handler\"], \"product\": \"khoj\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0-beta.0\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.1\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.2\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.3\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.4\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.5\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.6\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.7\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.8\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.9\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.10\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.11\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.12\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.13\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.14\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.15\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.16\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.17\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.18\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.19\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.20\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.21\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.22\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.23\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.24\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.25\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.26\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.27\"}, {\"status\": \"affected\", \"version\": \"2.0.0-beta.28\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-28T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-06-28T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-06-28T08:26:17.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/374516\", \"name\": \"VDB-374516 | khoj-ai khoj Conversation Sharing api_chat.py authorization\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/374516/cti\", \"name\": \"VDB-374516 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-13508\", \"name\": \"CVE-2026-13508 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/838812\", \"name\": \"Submit #838812 | Khoj AI Khoj Source commit e8631261400e0a04c5063e91e498b549976ffc53; affected released versions are unknown. CWE-863: Incorrect Authorization\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/khoj-ai/khoj/issues/1327\", \"tags\": [\"exploit\", \"issue-tracking\"]}, {\"url\": \"https://github.com/khoj-ai/khoj/pull/1328\", \"tags\": [\"issue-tracking\", \"patch\"]}, {\"url\": \"https://github.com/khoj-ai/khoj/\", \"tags\": [\"product\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"Incorrect Authorization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-06-28T21:45:10.327Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-13508\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-29T13:39:27.222Z\", \"dateReserved\": \"2026-06-28T06:21:13.647Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-06-28T21:45:10.327Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…