---
id: "CVE-2026-111716"
kind: "vulnerability"
aliases: ["CVE-2026-111716"]
title: "Arkon: authenticated employees can read and change other departments' sources"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["arkon", "multi-tenant", "other", "self-hosted"]
not_affected_if: ["single-department-deployment"]
published_at: "2026-10-16T18:17:55+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:18:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111716", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Arkon: authenticated employees can read and change other departments' sources

Arkon through 0.9.2 has a broken access control flaw in its by-id source routes, which skip the document permission check. An authenticated employee can read derived wiki titles and summaries of other departments' sources and change their ingestion state through the plan, progress, PATCH, retry and approve-extraction routes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Arkon version in use; the sources say versions through `0.9.2` are affected.
- Review `app/routers/sources.py` for by-id routes that do not call `can_access_document`.

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111716

## From the sources

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_