Missing Authorization in Arkon Skill Version Metadata Exposure

Executive Summary

Arkon through version 0.9.2 has a missing authorization vulnerability in the list_skill_versions endpoint. This flaw allows authenticated employees with default skill:read permission to bypass access controls and read metadata for skill versions belonging to other departments. Attackers can request GET /api/skills/{slug}/versions for non-owned skills to obtain sensitive details like version numbers, hashes, storage paths, and changelogs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized access to sensitive metadata of skills across departments. Attackers could gather internal information about versions, storage locations, and changes, potentially leading to further exploitation or data leaks. It undermines access control and could facilitate privilege escalation or targeted attacks on specific skills.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and data protection, such as GDPR (data confidentiality) and HIPAA (protected health information access). Unauthorized access to metadata could expose sensitive information, leading to regulatory penalties, loss of trust, and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update Arkon to the latest version beyond 0.9.2 to address the missing authorization flaw in list_skill_versions. Ensure proper access controls are enforced to prevent unauthorized access to skill version metadata.

Useful 0 Not Useful 0