EUVD-2026-103007
GHSA-h23m-p5hh-g2pm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with wiki:read:own_dept permission
-
ExploitRequest GET /api/wiki/graph with foreign department slug
-
Executionget_neighborhood() skips scope/authorization check
-
ImpactHarvest cross-department page metadata to depth 3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated Arkon account holding at least the wiki:read:own_dept permission - i.e., any ordinary employee-level user, so this is an insider/authenticated-user issue rather than remote-unauthenticated. The attacker must supply a foreign department's wiki slug to GET /api/wiki/graph; knowing or guessing a target slug is the only additional prerequisite. Exploitation is naturally LIMITED to read-only disclosure of metadata (slugs, titles, types, and link edges up to depth 3) - no page content bodies, no modification, and no availability impact - which caps the realistic damage regardless of how easily the request succeeds. |
| Impact | All signals converge on a LOW real-world priority. The CVSS 4.0 base score of 5.3 (Medium) reflects AV:N/AC:L/PR:L/UI:N with only VC:L and no integrity or availability impact - i.e., an easy-to-trigger but low-consequence confidentiality leak requiring a valid authenticated account. This is not a KEV entry (no confirmed active exploitation) and no EPSS score was supplied in the input, so widespread opportunistic exploitation cannot be quantified from the data available. A detailed public technical writeup (hackmd) and the exact vulnerable source lines on GitHub are referenced, which meaningfully lowers the barrier to crafting a working request even though no packaged weaponized exploit is flagged. The impact ceiling is narrow: the flaw exposes cross-department wiki METADATA (slugs, titles, types, link edges to depth 3) - not page bodies, credentials, or write access - so this is an authenticated internal information-disclosure/IDOR issue, not a critical breach vector. Net: a genuine but low-severity issue best triaged behind externally-facing or higher-impact findings. The signals are internally consistent (no CVSS-vs-description conflict); the main GAP is the absence of EPSS and any deployment-scale data for this obscure product. |
| Exploit ScenarioDerived | A legitimate employee holding only the wiki:read:own_dept permission authenticates normally, then calls GET /api/wiki/graph supplying a wiki slug belonging to another department. Because get_neighborhood() performs no scope check, the server returns that department's page slugs, titles, types, and link edges up to depth 3, letting the insider map confidential wiki structure they should not see. A public technical writeup and the vulnerable source lines are available, making the request trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Missing authorization in Arkon through 0.9.2 lets any authenticated employee who holds only the wiki:read:own_dept permission read another department's wiki metadata - page slugs, titles, node types and link edges up to depth three - by supplying a foreign department slug to GET /api/wiki/graph. Root cause is a CWE-639 user-controlled key flaw: the route passes the caller-supplied slug straight into get_neighborhood() without verifying that the requested department belongs to the requester, so an ordinary employee-level account is sufficient and no elevated role is needed. Impact is deliberately narrow (CVSS 5.3, and our own assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): read-only metadata disclosure only, with no page body content, no data modification and no availability impact; no public exploit identified at time of analysis, and exploitation merely requires knowing or guessing a target department slug.
RemediationAI
No vendor-released patch identified at time of analysis; the only upstream artifacts available are the vulnerable v0.9.2 source references (app/routers/wiki.py L621-L633 and app/services/wiki_service.py L200-L257), so any fix would have to come from the maintainer or from an internal code change - add a server-side scope check that resolves the requested slug, compares its owning department against the caller's department claims, and rejects the request before get_neighborhood() traverses edges (ideally also capping or filtering the returned link edges to in-scope nodes). Until such a fix is confirmed, the most effective compensating control with the smallest side effect is to block or restrict GET /api/wiki/graph at the reverse proxy or WAF - allow it only for users/roles that legitimately need the graph view - accepting the trade-off that the wiki graph/neighborhood visualization feature becomes unavailable to ordinary employees; since these are authenticated users, the proxy rule has to key on session identity or on graph requests carrying slugs outside the caller's department rather than on IP. If the graph view is not used in your deployment, simply disabling the route outright removes the exposure entirely with no data-integrity cost. Alternatively, narrow the wiki:read:own_dept grant so that only genuinely cross-department readers keep it, understanding that revoking it also removes normal department wiki read access for affected users. Because the only additional exploit prerequisite is knowing or guessing a foreign slug, switching slugs to non-enumerable random identifiers would raise the effort required but would not fix the underlying authorization flaw and should not be treated as a remedy. Monitor application and proxy logs for /api/wiki/graph calls using slugs outside the caller's department, and treat depth-3 metadata pulls from unexpected users as a signal of this IDOR activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Arkon is a Python web application (FastAPI-style app/routers and app/services layout) that organizes wiki content by department and enforces scoped permissions such as wiki:read:own_dept. The vulnerable path is a read endpoint, GET /api/wiki/graph (app/routers/wiki.py L621-L633), which is intended to render a wiki graph/neighborhood visualization and therefore returns lightweight node metadata - slugs, titles, types and link edges - rather than page bodies. The handler forwards the client-supplied slug parameter into the service function get_neighborhood() in app/services/wiki_service.py (L200-L257), which walks link edges up to depth 3 but performs no scope check against the caller's department before doing so. This maps to CWE-639 (Authorization Bypass Through User-Controlled Key), the classic IDOR pattern: the authorization decision is keyed on an identifier the attacker fully controls, and the permission gate that does exist (wiki:read:own_dept) validates only that the user may read their own department, never that the slug being requested is in it. CPE cpe:2.3:a:nduckmink:arkon:*:*:*:*:*:*:*:* confirms the affected package is nduckmink's Arkon across all versions through 0.9.2. Because the endpoint is read-only and returns derived graph metadata, the confidentiality exposure is bounded - cross-department data leakage of titles and link relationships (useful for reconnaissance and mapping internal structure) but not of the underlying content.
Know when Arkon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv user over the network (PR:L, AV:N, AC:L) triggers a metadata-only read, so C:L with I:N/A:N and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing authorization in Arkon 0.9.2 and earlier lets an authenticated employee holding only the default skill:read perm
Arkon deployments through version 0.9.2 allow authenticated, low-privileged employees to read and tamper with other depa
Exploit-DB