CVE-2026-111716: Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated employee is required. The vulnerability enables employees to access sources belonging to other departments by supplying foreign source IDs to affected by-ID routes.
Which operations are affected?
The affected by-ID routes include plan, progress, PATCH, retry, and approve-extraction. They can disclose derived wiki titles and summaries and allow changes to source ingestion state.
How can defenders determine whether they are exposed?
Review app/routers/sources.py for by-ID routes that do not call can_access_document before processing a source ID. Arkon versions through 0.9.2 are identified as affected.