CVE-2026-111717: Authorization Bypass Through User-Controlled Key in nduckmink arkon

CVE-2026-111717 describes a missing authorization check in the Arkon product (versions up to 0.9.2) in the list_skill_versions functionality. Authenticated employees holding the default skill:read permission can bypass the can_access_skill authorization check by requesting GET /api/skills/{slug}/versions for skills belonging to other departments. This results in unauthorized disclosure of skill version metadata including version numbers, hashes, storage paths, and changelogs.

The vulnerability allows unauthorized read access to sensitive skill version metadata across departments. While it does not allow modification or deletion, the exposure of hashes and storage paths could aid further reconnaissance or attacks. The CVSS score of 5.3 (medium severity) reflects the moderate impact due to unauthorized information disclosure without privilege escalation or code execution.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the skill:read permission to trusted users only and monitor API access for suspicious requests targeting other departments' skill versions.