CVE-2026-111715
Received Received - Intake

Arkon Missing Authorization in Wiki Graph API

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111715
EUVD
EUVD-2026-103007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nduckmink arkon 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Arkon through version 0.9.2 has a missing authorization vulnerability in the GET /api/wiki/graph endpoint. This flaw allows authenticated employees with limited permissions (wiki:read:own_dept) to read metadata from other departments' wikis by providing a foreign slug. The vulnerability occurs because the get_neighborhood() function does not perform scope checks, enabling attackers to retrieve page slugs, titles, types, and link edges up to a depth of 3.

Detection Guidance

To detect this vulnerability, check for unauthorized access to wiki metadata by authenticated users with limited permissions. Monitor API logs for GET requests to /api/wiki/graph with foreign slugs. Verify if users with wiki:read:own_dept permission can access other departments' data.

Impact Analysis

This vulnerability could allow unauthorized users to access sensitive wiki metadata from other departments, potentially exposing confidential information. While it does not directly modify or delete data, it breaches data segregation and could lead to information leaks or unauthorized reconnaissance within the system.

Compliance Impact

This vulnerability may violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data across departmental boundaries. It undermines data segregation principles and could result in non-compliance with privacy and security regulations that mandate strict access controls.

Mitigation Strategies

Immediately update Arkon to the latest version beyond 0.9.2. Implement strict scope checks in the get_neighborhood() function to enforce department-level access controls. Review and restrict wiki:read permissions to prevent unauthorized data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart