Live › vulnerability › CVE-2026-111715
Go to dashboardArkon through 0.9.2 lacks an authorization check on GET /api/wiki/graph, so an authenticated employee can pass a foreign slug. The response exposes wiki page slugs, titles, types and link edges from other departments up to depth 3.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Arkon through 0.9.2 with multiple departments sharing one wiki, where employees hold wiki:read:own_dept permission. Single-department or single-tenant installs have less to lose from this flaw. The sources do not say which Arkon release fixes it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
This page as .md · .json · in your agent: get_signal("CVE-2026-111715")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.