CVE-2026-111717

Arkon through 0.9.2 contains a missing authorization vulnerability in listskillversions that allows authenticated employees to read other departments' skill version metadata by bypassing the canaccessskill check. Attackers holding the default skill:read permission can request GET...

CVE-2026-111715

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:owndept permission can query getneighborhood without scope checks to obtain...

CVE-2026-111716

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111717 Arkon through 0.9.2 Missing Authorization via Skills Versions API

Arkon through 0.9.2 contains a missing authorization vulnerability in listskillversions that allows authenticated employees to read other departments' skill version metadata by bypassing the canaccessskill check. Attackers holding the default skill:read permission can request GET...

CVE-2026-111717

The Arkon software, through version 0.9.2 , is vulnerable to a missing authorization flaw in the list_skill_versions function. The root cause is a failure to properly enforce the can_access_skill check, allowing authenticated employees with the default skill:read permission to bypass intended res...

EUVD-2026-103009

Arkon through 0.9.2 contains a missing authorization vulnerability in listskillversions that allows authenticated employees to read other departments' skill version metadata by bypassing the canaccessskill check. Attackers holding the default skill:read permission can request GET...

CVE-2026-111715

Arkon versions through 0.9.2 are vulnerable to a missing authorization flaw in the GET /api/wiki/graph endpoint. Due to a lack of scope checks in the get_neighborhood() function, authenticated employees with wiki:read:own_dept permissions can access wiki metadata belonging to other departments by...

CVE-2026-111716 Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

EUVD-2026-103008

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

EUVD-2026-103007

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:owndept permission can query getneighborhood without scope checks to obtain...

CVE-2026-111716

The Arkon software (through version 0.9.2 ) is susceptible to a broken access control vulnerability in the app/routers/sources.py file. The root cause is that by-id routes fail to call the can_access_document function, allowing authenticated employees to bypass permissions. Exploitation allows an...

PT-2026-116114

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own dept permission can query get neighborhood without scope checks to obtai...

PT-2026-116116

Arkon through 0.9.2 contains a missing authorization vulnerability in list skill versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can access skill check. Attackers holding the default skill:read permission can request GET...

PT-2026-116115

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can access document. Attackers can call the plan, progress, PATCH, retry and approve-extraction...