Threats tagged 'ghsa-h23m-p5hh-g2pm'

Arkon versions up to 0.9.2 have an authorization bypass vulnerability in the GET /api/wiki/graph endpoint. Authenticated users with limited wiki read permissions can access wiki metadata from other departments by supplying a foreign slug. This allows unauthorized reading of page slugs, titles, types, and link edges up to depth 3.