khoj CVE-2026-13508

khoj is an open-source Django-based AI personal assistant that supports user-defined 'agents' - AI personas with configurable personality instructions and tiered privacy levels (PUBLIC, PROTECTED, PRIVATE). The vulnerable component is the Conversation Sharing Handler in src/khoj/routers/api_chat.py (CWE-285: Improper Authorization). The root cause is that when creating a public copy of a conversation via create_conversation_from_public_conversation, and when resolving agents during chat generation in helpers.py and api_chat.py, the code passed conversation.agent directly into the resulting context without re-validating whether the requesting user holds permission to use that specific agent. The PR #1328 diff confirms three distinct code paths lacked authorization guards: the conversation copy constructor, the synchronous chat response path, and the async agenerate_chat_response helper. The fix introduces get_agent_accessible_to_user_or_default and its async variant to enforce privacy-level checks (PUBLIC passthrough, creator match, PROTECTED passthrough, else fallback to default agent) at each of these call sites.