Broken Access Control in Arkon Affects Employee Source Access

CVE-2026-111716

What is CVE-2026-111716?

Arkon version 0.9.2 has a vulnerability stemming from broken access control mechanisms, permitting authenticated employees to access and modify sensitive sources across different departments. This issue arises because certain by-ID routes in the app/routers/sources.py file inadequately check permissions, allowing attackers to exploit the plan, progress, PATCH, retry, and approve-extraction routes using foreign source IDs. Consequently, attackers can disclose confidential wiki titles and summaries as well as manipulate the ingestion state.

References