Live › vulnerability › CVE-2026-111717
Go to dashboardArkon through 0.9.2 fails to check department access in the list_skill_versions endpoint, so any authenticated employee can list version metadata for skills owned by other departments. Exposed fields include version numbers, hashes, storage paths and changelogs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Arkon up to and including 0.9.2 with more than one department sharing skills on the same instance. Single-department deployments see little difference because the leak is cross-department. Deployments that do not use multi-department skill separation can skip it.
No product ranges from the sources yet.
unknown whether it is 0.9.2 or earlier from the sources aloneunknown from the sources)0.9.2 once a fixed release is published (fixed version: unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111717")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.