CVE-2026-111716
MediumCVSS 5.4Summary
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
Risk Assessment
Employees can unauthorizedly read and modify other departments' source data, potentially leading to information leakage and data manipulation. This can compromise system integrity and data confidentiality.
Recommendation
Update Arkon to a version later than 0.9.2 that fixes this vulnerability. Until then, consider implementing additional application-level access controls or monitoring unusual source operations.
Other vulnerabilities in Arkon
See all- CVE-2026-111717Medium
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
- CVE-2026-111715Medium
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
Original NVD description (English source)
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS