CVE-2026-111716
Received Received - Intake

Broken Access Control in Arkon Allows Unauthorized Source Modification

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111716
EUVD
EUVD-2026-103008

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nduckmink arkon 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Arkon through version 0.9.2 has a broken access control flaw in app/routers/sources.py. Authenticated employees can bypass document access checks by using by-id routes to read or modify sources belonging to other departments. This allows viewing derived wiki titles and summaries or altering ingestion states via routes like plan, progress, PATCH, retry, and approve-extraction.

Detection Guidance

Check for unauthorized access to sources by reviewing logs for calls to routes like plan, progress, PATCH, retry, and approve-extraction with foreign source IDs. Inspect app/routers/sources.py for missing can_access_document checks in by-id routes.

Impact Analysis

If you are an authenticated employee using Arkon 0.9.2 or earlier, attackers with your access level could read sensitive data from other departments or change ingestion processes. This could lead to unauthorized data exposure or disruption of content management workflows.

Compliance Impact

This vulnerability may violate data protection requirements by enabling unauthorized access to sensitive information across departments. GDPR and HIPAA mandate strict access controls and data segregation; this flaw could lead to non-compliance, potential fines, and loss of trust due to unauthorized data exposure or modification.

Mitigation Strategies

Update Arkon to a version that fixes the broken access control in app/routers/sources.py. Ensure all by-id routes enforce can_access_document checks. Restrict access to authenticated employees only and audit source access permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111716. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart