ArcherySec versions through 2.0.6 contain a vulnerability in the WebScanVulnList endpoint where organization ownership is not properly validated. This flaw allows authenticated users to access vulnerability findings belonging to other organizations by supplying arbitrary scan identifiers. The exposed data includes vulnerability titles, severities, statuses, and analyst notes. The vulnerability has a CVSS score of 6.5, indicating a high severity impact on confidentiality without affecting integrity or availability.