Threat Intelligence Database

Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.

Arkon versions up to 0.9.2 have an authorization bypass vulnerability that allows authenticated users to access and modify data from other departments. This occurs because certain routes in the application skip access control checks, enabling unauthorized reading and modification of source data.

A missing authorization vulnerability in nduckmink arkon up to version 0.9.2 allows authenticated employees with limited wiki read permissions to access metadata from other departments' wikis by manipulating a user-controlled key in the GET /api/wiki/graph endpoint. This enables unauthorized reading of page slugs, titles, types, and link edges up to a depth of 3.