CVE-2024-52294 khoj has an IDOR in subscription management that allows unauthorized subscription modifications

What is CVE-2024-52294?

CVE-2024-52294 is a medium-severity missing authorization vulnerability in khoj-ai khoj, published on 30 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. The vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription. The issue was fixed in version 1.29.10. Support for arbitrarily presenting an email for update has been deprecated.

Weakness: CWE-639

Which versions are affected by CVE-2024-52294?

3 open source packages ship an affected version, including khoj.

How do I fix CVE-2024-52294?

Upgrade khoj to 1.29.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-52294 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52294 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hq4h-w933-jm6c, PYSEC-2026-1493.