Information Disclosure Vulnerability in ArcherySec Affected by Misconfigured WebScanVulnList Endpoint

CVE-2026-92765

What is CVE-2026-92765?

The ArcherySec product, specifically version 2.0.6, is vulnerable due to inadequate validation of organizational ownership within the WebScanVulnList endpoint. This flaw permits authenticated users to exploit the system by supplying arbitrary scan identifiers. As a result, they can access sensitive vulnerability findings from other organizations, which might include critical web vulnerability data, such as titles, severities, statuses, and detailed analyst notes. This presents significant security concerns as it compromises data isolation among tenants, potentially leading to further exploitation.

References