Missing Authorization in Arkon API Allows Unauthorized Data Access

CVE-2026-111717

What is CVE-2026-111717?

Arkon versions up to 0.9.2 contain a missing authorization flaw in the list_skill_versions function, which can be exploited by authenticated employees. This vulnerability allows users with the default skill:read permission to bypass the can_access_skill check. Consequently, attackers can access sensitive metadata from other departments, including skill version numbers, hashes, storage paths, and changelogs via the GET /api/skills/{slug}/versions endpoint. Organizations using affected versions must implement immediate remediation measures to secure their data.

References