Threat database

Arkon versions up to 0.9.2 have an authorization bypass vulnerability in the list_skill_versions API endpoint. Authenticated users with the default skill:read permission can access skill version metadata from other departments without proper authorization checks. This allows them to retrieve version numbers, hashes, storage paths, and changelogs of skills they should not have access to.

Arkon versions up to 0.9.2 have an authorization bypass vulnerability allowing authenticated employees to access and modify sources from other departments. This occurs because certain routes in the application skip access control checks, enabling unauthorized reading and modification of data.

Arkon versions up to 0.9.2 have an authorization bypass vulnerability in the GET /api/wiki/graph endpoint. Authenticated users with limited wiki read permissions can access wiki metadata from other departments by supplying a foreign slug. This allows unauthorized reading of page slugs, titles, types, and link edges up to depth 3.