CVE-2026-111715
MediumCVSS 4.3Summary
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
Risk Assessment
Employees can access wiki metadata of other departments, breaching data isolation and potentially exposing confidential information. This can lead to leakage of internal information.
Recommendation
Update Arkon to a version later than 0.9.2 that fixes this vulnerability. Until then, consider restricting wiki:read:own_dept permissions or monitoring unusual requests to /api/wiki/graph.
Other vulnerabilities in Arkon
See all- CVE-2026-111717Medium
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
- CVE-2026-111716Medium
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
Original NVD description (English source)
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS