CVE-2026-111716 — Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7