CVE-2026-111716 Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111716

The Arkon software (through version 0.9.2 ) is susceptible to a broken access control vulnerability in the app/routers/sources.py file. The root cause is that by-id routes fail to call the can_access_document function, allowing authenticated employees to bypass permissions. Exploitation allows an...