{"id":"CVE-2026-111716","kind":"vulnerability","aliases":["CVE-2026-111716"],"related":[],"title":"Arkon: authenticated employees can read and change other departments' sources","description":"Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.","summary":"Arkon through 0.9.2 has a broken access control flaw in its by-id source routes, which skip the document permission check. An authenticated employee can read derived wiki titles and summaries of other departments' sources and change their ingestion state through the plan, progress, PATCH, retry and approve-extraction routes.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arkon","multi-tenant","other","self-hosted"],"not_affected_if":["single-department-deployment"],"how_to_check":"- Check the Arkon version in use; the sources say versions through `0.9.2` are affected.\n- Review `app/routers/sources.py` for by-id routes that do not call `can_access_document`.","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:55+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:18:16+00:00","updated_at":"2026-10-25T04:18:16+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:18:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Arkon: authenticated employees can read and change other departments' sources","impact":"medium","summary":"Arkon through 0.9.2 has a broken access control flaw in its by-id source routes, which skip the document permission check. An authenticated employee can read derived wiki titles and summaries of other departments' sources and change their ingestion state through the plan, progress, PATCH, retry and approve-extraction routes.","category":"other","nicknames":[],"who_cares":["arkon","self-hosted","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Employees read and alter other departments' sources and ingestion state.","analyst_note":"Check the Arkon repository or NVD entry for a fixed version and confirm the affected routes.","how_to_check":"- Check the Arkon version in use; the sources say versions through `0.9.2` are affected.\n- Review `app/routers/sources.py` for by-id routes that do not call `can_access_document`.","needs_analyst":true,"not_affected_if":["single-department-deployment"],"who_is_affected":"Teams running Arkon 0.9.2 or earlier with multiple departments sharing one instance, where employees hold accounts. Single-department or single-user deployments have less exposure to cross-department reads. unknown whether the sources name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000586,"input_tokens":3346,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111716':13A,16A '-2026':12A,15A '0.9.2':27B,79C 'access':31B,83C,106C 'allow':87C 'alter':133C 'app/routers/sources.py':103C 'approv':74B,118C 'approve-extract':73B,117C 'arkon':1A,17B,25B,77C 'attack':108C 'authent':2A,48B,88C 'broken':30B,82C 'by-id':36B,98C 'call':110C 'chang':7A,62B 'check':46B 'contain':80C 'control':32B,84C 'cve':11A,14A 'depart':9A,59B,95C 'deriv':52B,127C 'disclos':126C 'document':44B,107C 'employe':3A,49B,89C 'extract':75B,119C 'flaw':33B 'foreign':122C 'host':24B 'id':38B,100C,124C 'ingest':64B,134C 'modifi':93C 'multi':19B 'multi-ten':18B 'patch':70B,114C 'permiss':45B 'plan':68B,112C 'progress':69B,113C 'read':5A,51B,91C 'retri':71B,115C 'rout':40B,76B,101C,120C 'self':23B 'self-host':22B 'skip':42B,104C 'sourc':10A,39B,60B,96C,123C 'state':65B,135C 'summari':56B,131C 'tenant':20B 'titl':54B,129C 'vulner':85C 'wiki':53B,128C","nicknames":[],"mitigations":[],"who_affected":"Teams running Arkon 0.9.2 or earlier with multiple departments sharing one instance, where employees hold accounts. Single-department or single-user deployments have less exposure to cross-department reads. unknown whether the sources name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111716","severity":null,"published_at":"2026-10-16T18:17:55+00:00","modified_at":"2026-10-16T22:17:23+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}