Skip to content
OpenAdvisories

Vendor

nduckmink

3 known vulnerabilities.

Products

arkon 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-111717

    Arkon through 0.9.2 Missing Authorization via Skills Versions API

    Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read p…

    nduckmink arkon
  • Medium 5.4
    CVE-2026-111716

    Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

    Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress…

    nduckmink arkon
  • Medium 4.3
    CVE-2026-111715

    Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

    Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neig…

    nduckmink arkon