CVE-2026-111717

Published: Oct 16, 2026Modified: Oct 16, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (5)

https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py#L408-L425

Source: disclosure@vulncheck.com

https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py#L427-L434

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/arkon-through-0.9.2-missing-authorization-via-skills-versions-api

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.