Arkon through 0.9.2 Missing Authorization via Skills Versions API

Advisories

Arkon through 0.9.2 Missing Authorization via Skills Versions API

Severity: medium
Date: 10/16/2026
Affecting: arkon <= 0.9.2
CVE: CVE-2026-111717
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor
https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py#L427-L434
https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py#L408-L425
Credit: hieuPenguinnn
Description: Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo