Arkon EUVD-2026-103009

Requires a valid authenticated account holding the default skill:read permission (PR:L) - exploitation is limited to existing insiders/employees, not anonymous internet attackers. The attacker must know or enumerate the slug of a target skill belonging to another department and call GET /api/skills/{slug}/versions on Arkon 0.9.2 or earlier; the flaw triggers because list_skill_versions does not invoke the can_access_skill authorization check. No user interaction, no non-default configuration, and no elevated role are needed, so any multi-department deployment where ordinary users have the baseline read permission is exposed; single-department or single-tenant installs have no cross-boundary data to leak.

This is a genuine but modest-severity information-disclosure issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the description agree: an attacker needs a valid authenticated account (PR:L - any employee holding the default skill:read permission), but no user interaction and no special attack requirements, exploiting over the network at low complexity. Impact is confined to low confidentiality (VC:L, VI:N, VA:N) - exposure of skill version metadata (version numbers, hashes, storage paths, changelogs) across department boundaries, with no integrity or availability effect. No EPSS score, CISA KEV listing, or SSVC decision point is present in the input, so there is no evidence of active exploitation; this is CWE-639 (authorization bypass through user-controlled key, i.e. a cross-tenant/IDOR). Bottom line: this is a real but low-priority bug - a horizontal privilege/authorization gap usable only by existing authenticated insiders to read (not modify) non-sensitive-to-moderate metadata. It is not a drop-everything critical, but the low attack complexity and default-permission precondition mean any authenticated user base can trivially reach it, so it warrants prompt patching in multi-department deployments.

An authenticated employee in Department A, holding only the default skill:read permission, enumerates or guesses the slug of a skill owned by Department B and issues GET /api/skills/{slug}/versions. Because list_skill_versions omits the can_access_skill check, the server returns Department B's version numbers, content hashes, storage paths, and changelogs. A public technical write-up describing the flaw exists (hackmd analysis plus the vulnerable source lines on GitHub), but no weaponized exploit code was identified in the provided data.