Arkon
Monthly
Missing authorization in Arkon 0.9.2 and earlier lets an authenticated employee holding only the default skill:read permission read another department's skill version metadata via GET /api/skills/{slug}/versions, exposing version numbers, hashes, storage paths and changelogs that should be scoped to the owning department. The root cause is an omitted can_access_skill check in the list_skill_versions handler, i.e. a CWE-639 authorization bypass through a user-controlled key, and no elevated role, user interaction, or non-default configuration is required beyond knowing or enumerating a target skill slug. Exploitation is limited to existing insiders with a valid account on a multi-department deployment, so single-department or single-tenant installs have no cross-boundary data to leak; no public exploit code was identified at time of analysis and the issue is assessed as a genuine but modest-severity information-disclosure weakness rather than a critical compromise vector.
Arkon deployments through version 0.9.2 allow authenticated, low-privileged employees to read and tamper with other departments' source ingestion records because the by-id routes in app/routers/sources.py (plan, progress, PATCH, retry, approve-extraction) omit the can_access_document authorization check. An attacker with a valid account only needs to know or enumerate a foreign source ID to disclose derived wiki titles and summaries and to change ingestion state; raw source content is not exposed and there is no availability impact. Per the independent assessment this is a moderate authorization-layer (IDOR) flaw requiring PR:L credentials, with no public exploit identified at time of analysis and no CISA KEV listing.
Missing authorization in Arkon through 0.9.2 lets any authenticated employee who holds only the wiki:read:own_dept permission read another department's wiki metadata - page slugs, titles, node types and link edges up to depth three - by supplying a foreign department slug to GET /api/wiki/graph. Root cause is a CWE-639 user-controlled key flaw: the route passes the caller-supplied slug straight into get_neighborhood() without verifying that the requested department belongs to the requester, so an ordinary employee-level account is sufficient and no elevated role is needed. Impact is deliberately narrow (CVSS 5.3, and our own assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): read-only metadata disclosure only, with no page body content, no data modification and no availability impact; no public exploit identified at time of analysis, and exploitation merely requires knowing or guessing a target department slug.
Missing authorization in Arkon 0.9.2 and earlier lets an authenticated employee holding only the default skill:read permission read another department's skill version metadata via GET /api/skills/{slug}/versions, exposing version numbers, hashes, storage paths and changelogs that should be scoped to the owning department. The root cause is an omitted can_access_skill check in the list_skill_versions handler, i.e. a CWE-639 authorization bypass through a user-controlled key, and no elevated role, user interaction, or non-default configuration is required beyond knowing or enumerating a target skill slug. Exploitation is limited to existing insiders with a valid account on a multi-department deployment, so single-department or single-tenant installs have no cross-boundary data to leak; no public exploit code was identified at time of analysis and the issue is assessed as a genuine but modest-severity information-disclosure weakness rather than a critical compromise vector.
Arkon deployments through version 0.9.2 allow authenticated, low-privileged employees to read and tamper with other departments' source ingestion records because the by-id routes in app/routers/sources.py (plan, progress, PATCH, retry, approve-extraction) omit the can_access_document authorization check. An attacker with a valid account only needs to know or enumerate a foreign source ID to disclose derived wiki titles and summaries and to change ingestion state; raw source content is not exposed and there is no availability impact. Per the independent assessment this is a moderate authorization-layer (IDOR) flaw requiring PR:L credentials, with no public exploit identified at time of analysis and no CISA KEV listing.
Missing authorization in Arkon through 0.9.2 lets any authenticated employee who holds only the wiki:read:own_dept permission read another department's wiki metadata - page slugs, titles, node types and link edges up to depth three - by supplying a foreign department slug to GET /api/wiki/graph. Root cause is a CWE-639 user-controlled key flaw: the route passes the caller-supplied slug straight into get_neighborhood() without verifying that the requested department belongs to the requester, so an ordinary employee-level account is sufficient and no elevated role is needed. Impact is deliberately narrow (CVSS 5.3, and our own assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): read-only metadata disclosure only, with no page body content, no data modification and no availability impact; no public exploit identified at time of analysis, and exploitation merely requires knowing or guessing a target department slug.