{"id":66734,"date":"2026-06-28T17:32:07","date_gmt":"2026-06-28T17:32:07","guid":{"rendered":"https:\/\/zero.redgem.net\/?p=66734"},"modified":"2026-06-28T17:32:07","modified_gmt":"2026-06-28T17:32:07","slug":"khoj-ai-khoj-conversation-sharing-apichatpy-authorization","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=66734","title":{"rendered":"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508"},"content":{"rendered":"

{“lastseen”:””,”description”:”A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src\/khoj\/routers\/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.”,”published”:”2026-06-28T21:45:10.327Z”,”modified”:”2026-06-28T21:45:10.327Z”,”type”:”cve”,”title”:”khoj-ai khoj Conversation Sharing api_chat.py authorization”,”source”:”VulDB”,”references”:”https:\/\/vuldb.com\/vuln\/374516\\nhttps:\/\/vuldb.com\/vuln\/374516\/cti\\nhttps:\/\/vuldb.com\/cve\/CVE-2026-13508\\nhttps:\/\/vuldb.com\/submit\/838812\\nhttps:\/\/github.com\/khoj-ai\/khoj\/issues\/1327\\nhttps:\/\/github.com\/khoj-ai\/khoj\/pull\/1328\\nhttps:\/\/github.com\/khoj-ai\/khoj\/”,”id”:”CVE-2026-13508″,”bulletinFamily”:””,”cwe”:[“CWE-863″,”CWE-285″],”cvelist”:null,”sourceData”:”khoj-ai khoj 2.0.0-beta.0\\nkhoj-ai khoj 2.0.0-beta.1\\nkhoj-ai khoj 2.0.0-beta.2\\nkhoj-ai khoj 2.0.0-beta.3\\nkhoj-ai khoj 2.0.0-beta.4\\nkhoj-ai khoj 2.0.0-beta.5\\nkhoj-ai khoj 2.0.0-beta.6\\nkhoj-ai khoj 2.0.0-beta.7\\nkhoj-ai khoj 2.0.0-beta.8\\nkhoj-ai khoj 2.0.0-beta.9\\nkhoj-ai khoj 2.0.0-beta.10\\nkhoj-ai khoj 2.0.0-beta.11\\nkhoj-ai khoj 2.0.0-beta.12\\nkhoj-ai khoj 2.0.0-beta.13\\nkhoj-ai khoj 2.0.0-beta.14\\nkhoj-ai khoj 2.0.0-beta.15\\nkhoj-ai khoj 2.0.0-beta.16\\nkhoj-ai khoj 2.0.0-beta.17\\nkhoj-ai khoj 2.0.0-beta.18\\nkhoj-ai khoj 2.0.0-beta.19\\nkhoj-ai khoj 2.0.0-beta.20\\nkhoj-ai khoj 2.0.0-beta.21\\nkhoj-ai khoj 2.0.0-beta.22\\nkhoj-ai khoj 2.0.0-beta.23\\nkhoj-ai khoj 2.0.0-beta.24\\nkhoj-ai khoj 2.0.0-beta.25\\nkhoj-ai khoj 2.0.0-beta.26\\nkhoj-ai khoj 2.0.0-beta.27\\nkhoj-ai khoj 2.0.0-beta.28″,”sourceHref”:””,”cvss”:{“score”:5.1,”severity”:”MEDIUM”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:L\/VI:L\/VA:L\/SC:N\/SI:N\/SA:N\/E:P”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”khoj”,”version”:”2.0.0-beta.0″,”vendor”:”khoj-ai”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"

{“lastseen”:””,”description”:”A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src\/khoj\/routers\/api_chat.py of the component Conversation Sharing…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,109,12,21,13,7,11,5],"class_list":["post-66734","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-51","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\nkhoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508 - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=66734\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508 - zero redgem\" \/>\n<meta property=\"og:description\" content=\"{“lastseen”:””,”description”:”A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src\/khoj\/routers\/api_chat.py of the component Conversation Sharing...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=66734\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-28T17:32:07+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=66734#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=66734\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508\",\"datePublished\":\"2026-06-28T17:32:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=66734\"},\"wordCount\":318,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-5.1\",\"exploit\",\"MEDIUM\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_cve\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=66734#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=66734\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=66734\",\"name\":\"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508 - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2026-06-28T17:32:07+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=66734#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=66734\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=66734#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508 - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=66734","og_locale":"en_US","og_type":"article","og_title":"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508 - zero redgem","og_description":"{“lastseen”:””,”description”:”A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src\/khoj\/routers\/api_chat.py of the component Conversation Sharing...","og_url":"https:\/\/zero.redgem.net\/?p=66734","og_site_name":"zero redgem","article_published_time":"2026-06-28T17:32:07+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=66734#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=66734"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508","datePublished":"2026-06-28T17:32:07+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=66734"},"wordCount":318,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-5.1","exploit","MEDIUM","news","Security","tapic","Vulnerability"],"articleSection":["category_cve"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=66734#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=66734","url":"https:\/\/zero.redgem.net\/?p=66734","name":"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508 - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2026-06-28T17:32:07+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=66734#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=66734"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=66734#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"khoj-ai khoj Conversation Sharing api_chat.py authorization_CVE-2026-13508"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/66734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=66734"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/66734\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=66734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=66734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=66734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}