CVE-2026-111717
MediumCVSS 4.3Summary
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
Risk Assessment
Employees can access version information of skills belonging to other departments, breaching data isolation and potentially exposing sensitive metadata. This can lead to leakage of internal information and violation of security policies.
Recommendation
Update Arkon to a version later than 0.9.2 that fixes this vulnerability. Until then, consider restricting skill:read permissions or monitoring unusual requests to the /api/skills/{slug}/versions endpoint.
Other vulnerabilities in Arkon
See all- CVE-2026-111716Medium
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
- CVE-2026-111715Medium
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
Original NVD description (English source)
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS