CVE-2026-111717: Arkon through 0.9.2 Missing Authorization via Skills Versions API
Arkon through 0.9.2 contains a missing authorization vulnerability in listskillversions that allows authenticated employees to read other departments' skill version metadata by bypassing the canaccessskill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated employee holding the default skill:read permission can exploit it. The attacker does not need access to the target department's skill.
What information can be exposed?
A successful request can disclose another department's skill version metadata, including version numbers, hashes, storage paths, and changelogs.
Which endpoint should be reviewed for exposure?
Review access to GET /api/skills/{slug}/versions, particularly requests for skill slugs belonging to departments other than the requesting employee's department.