CVE-2026-111715: Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:owndept permission can query getneighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated employee with only the wiki:read:own_dept permission can exploit it. The attacker must be able to send a request to the GET /api/wiki/graph endpoint and provide a slug for another department.
What information can be exposed?
The endpoint can disclose wiki metadata from another department, including page slugs, titles, page types, and link edges. The graph traversal can return this information up to depth 3.
Are unauthenticated users affected?
No. Exploitation requires an authenticated employee account; the described vulnerable permission level is wiki:read:own_dept.