CVE-2026-111715

MEDIUM 4.3

Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.

CWE	CWE-639
Vendor	nduckmink
Product	arkon
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for nduckmink arkon

Be the first to know when new medium vulnerabilities affecting nduckmink arkon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

nduckmink / arkon

0 ≤ 0.9.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor github.com: https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/wiki.py#L621-L633 github.com: https://github.com/nduckmink/arkon/blob/v0.9.2/app/services/wiki_service.py#L200-L257 vulncheck.com: https://www.vulncheck.com/advisories/arkon-through-0.9.2-missing-authorization-via-wiki-graph-neighborhood-api

Credits

hieuPenguinnn