Live › vulnerability › CVE-2026-111716
Go to dashboardArkon through 0.9.2 has a broken access control flaw in its by-id source routes, which skip the document permission check. An authenticated employee can read derived wiki titles and summaries of other departments' sources and change their ingestion state through the plan, progress, PATCH, retry and approve-extraction routes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Arkon 0.9.2 or earlier with multiple departments sharing one instance, where employees hold accounts. Single-department or single-user deployments have less exposure to cross-department reads. unknown whether the sources name a fixed version.
No product ranges from the sources yet.
0.9.2 are affected.app/routers/sources.py for by-id routes that do not call can_access_document.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
This page as .md · .json · in your agent: get_signal("CVE-2026-111716")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.