Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

Advisories

Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

Severity: medium
Date: 10/16/2026
Affecting: arkon <= 0.9.2
CVE: CVE-2026-111715
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor
https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/wiki.py#L621-L633
https://github.com/nduckmink/arkon/blob/v0.9.2/app/services/wiki_service.py#L200-L257
Credit: hieuPenguinnn
Description: Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo