CVE-2026-111715: Authorization Bypass Through User-Controlled Key in nduckmink arkon

CVE-2026-111715 describes an authorization bypass vulnerability in nduckmink arkon versions up to 0.9.2. The flaw exists in the GET /api/wiki/graph API endpoint, where authenticated users with only wiki:read:own_dept permission can supply a foreign slug to bypass scope checks in the get_neighborhood() function. This allows them to retrieve wiki metadata from other departments, including page slugs, titles, types, and link edges up to three levels deep. The vulnerability is due to missing authorization controls on the user-controlled key parameter.

Authenticated users with limited read permissions can access wiki metadata beyond their authorized scope, potentially exposing sensitive organizational information about other departments. The vulnerability does not require elevated privileges beyond wiki:read:own_dept and does not involve privilege escalation or code execution. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality.

No patch or official fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict access to the GET /api/wiki/graph endpoint to trusted users or implement additional access controls to enforce department boundaries. Review and limit permissions granted to users to minimize exposure.