CVE-2026-13508: Khoj AI Conversation Authorization Bypass (CVSS 5.5)

Technical summary

CVE-2026-13508 is an authorization flaw in the Conversation Sharing Handler within src/khoj/routers/api_chat.py. The vulnerability stems from improper authorization checks when processing the conversation.agent argument. An authenticated attacker can manipulate this parameter to bypass access controls, allowing them to read or modify conversation data they lack permission to access. The issue is classified under CWE-285 (Improper Authorization) and CWE-863 (Incorrect Authorization), indicating a fundamental gap in the application's permission enforcement logic. Remote exploitation is possible without elevated privileges.

Business impact

For organizations deploying Khoj as an internal knowledge assistant or customer-facing conversational interface, this vulnerability enables data exfiltration and manipulation of sensitive discussions. Authenticated users—including contractors, former employees with lingering access, or compromised internal accounts—could access confidential conversations, retrieve proprietary information, or inject malicious responses into shared conversations. In multi-tenant or BYOK (Bring Your Own Knowledge) scenarios, the blast radius expands to customer data. While the CVSS score of 5.5 reflects moderate severity, the confidentiality and integrity impact warrants immediate attention, especially if Khoj processes regulated information (healthcare, legal, financial discussions).

Affected systems

Khoj AI's khoj product is affected in all versions up to and including 2.0.0-beta.28. The vulnerability exists in the conversation API router and impacts any deployment where conversation sharing is enabled or accessible to multiple users. This includes self-hosted instances, cloud deployments, and any integration where the Khoj API is exposed to authenticated users.

Exploitability

The vulnerability is exploitable by any authenticated user with network access to the Khoj API endpoint. No special privileges, elevated credentials, or user interaction is required beyond the initial authentication. The attack surface is broad because the flaw resides in a core API router. Public disclosure of an exploit means adversaries have functional proof-of-concept code; however, the requirement for prior authentication limits blast radius compared to unauthenticated exploits. Organizations should assume malicious insiders or accounts compromised through phishing are immediate threats.

Remediation

Update Khoj to a patched version once released and the pending pull request is merged. Immediately after patching, audit conversation access logs to detect unauthorized access during the vulnerability window. Implement network segmentation to restrict API access to trusted networks. Review user access permissions and revoke credentials for accounts that are no longer needed. If a patch is not yet available, consider temporarily disabling conversation sharing features or restricting API access to a whitelist of known-safe client applications until a fix is deployed.

Patch guidance

Monitor the Khoj project repository and official advisories for a release that addresses this CVE. The fix is currently pending in a pull request, so verify the merged version number against the vendor's security advisory or release notes before deploying. Once a patched version is available, apply it across all Khoj instances in your environment. Test the patch in a staging environment to ensure conversation sharing and agent manipulation are properly restricted. Verify that legitimate users retain expected access permissions after patching.

Detection guidance

Monitor API access logs for repeated or suspicious calls to the conversation endpoints (src/khoj/routers/api_chat.py) with varying conversation.agent parameter values, particularly from a single user account accessing conversations outside their normal scope. Set alerts for authentication tokens being used to access conversations that don't match the token's assigned scope. Review conversation access patterns for anomalies such as bulk exports, rapid sequential access to multiple conversations, or access to conversations from different organizational units or teams. Implement API request logging that captures the conversation.agent parameter values to establish a baseline of normal behavior.

Why prioritize this

Although the CVSS score is moderate (5.5), the vulnerability should be prioritized due to the published exploit, the direct impact on data confidentiality and integrity, and the low barrier to exploitation (requires only authentication, which is abundant in most organizations). This is especially critical if Khoj is used to process or store sensitive business information, customer data, or regulated content. The attack surface is the API router itself, making it a likely target for compromise post-initial breach or insider threat scenarios.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), requiring low privileges—authenticated access (PR:L), and requiring user interaction (UI:R). The impact is limited to low confidentiality, low integrity, and low availability loss. The moderate score appropriately captures that an attacker needs to authenticate and trigger the action, but underweights the insider threat and post-compromise scenarios where this flaw becomes critical. Organizations handling sensitive conversations should treat this above its numerical score.

Frequently asked questions