Read the docs
TI-2024-34969 Aliases CVE-2024-52294GHSA-hq4h-w933-jm6c

khoj has an IDOR in subscription management that allows unauthorized subscription modifications

Priority MEDIUM 53CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. The vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription. The issue was fixed in version 1.29.10. Support for arbitrarily presenting an email for update has been deprecated.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Fix Fixed khoj (khoj-ai): 1.29.0khoj (PyPI): 1.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
khoj-aikhojbefore 1.29.01.29.0Patch availableCNA
—khoj (PyPI)before 1.29.01.29.0Patch availableGHSA-hq4h-w933-jm6c
  • khoj Vendorkhoj-ai Affected before 1.29.0 Fixed in 1.29.0 Patch available CNA
  • khoj (PyPI) Vendor— Affected before 1.29.0 Fixed in 1.29.0 Patch available GHSA-hq4h-w933-jm6c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:khoj:khoj:*:*:*:*:*:*:*:*——khoj-ai
  • cpe:2.3:a:khoj:khoj:*:*:*:*:*:*:*:* Versions — — ·khoj-ai

Remediation

  • Fix · CNA khoj (khoj-ai) Fixed in 1.29.0
  • Fix · GHSA-hq4h-w933-jm6c khoj (PyPI) Fixed in 1.29.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52294
  2. 2026-10-03 Alias added: GHSA-hq4h-w933-jm6c

References

Advisory 1

Other 3

  • TI-2024-16867 Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients CVSS 3.1HIGH 7.5
  • TI-2025-42661 Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning CVSS 3.1HIGH 7.1
  • TI-2026-11433 khoj-ai khoj Conversation Sharing api_chat.py authorization CVSS 4.0MEDIUM 5.1
  • TI-2024-29045 Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences