Missing Authorization Vulnerability in Arkon Affected by Cross-Department Access

CVE-2026-111715

What is CVE-2026-111715?

The vulnerability in Arkon prior to version 0.9.2 arises from a missing authorization check in the GET /api/wiki/graph endpoint. This flaw allows authenticated employees with limited permissions (wiki:read:own_dept) to access and read wiki metadata belonging to other departments by manipulating the foreign slug. Attackers can exploit this oversight to send unauthorized requests, obtaining sensitive information such as page slugs, titles, types, and link edges up to a depth of three, leading to potential information leaks and cross-department exposure.

References