PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111715 nduckmink CVE debrief

CVE-2026-111715 is a missing authorization vulnerability in Arkon through version 0.9.2, affecting the Wiki Graph Neighborhood API. Authenticated employees with wiki:read:own_dept permission can read other departments' wiki metadata by supplying a foreign slug, potentially exposing page slugs, titles, types, and link edges up to depth 3. This vulnerability could allow unauthorized access to sensitive information and increase the risk of data breaches. Defenders should assess exposure and prioritize remediation, especially in multi-departmental environments.

Vendor
nduckmink
Product
arkon
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-19
Advisory published
2026-10-16
Advisory updated
2026-10-19

Who should care

Defenders and administrators of Arkon deployments, especially in multi-departmental environments, should assess exposure and prioritize remediation. This vulnerability could allow unauthorized access to sensitive information and increase the risk of data breaches. Defenders should verify and remediate this vulnerability to prevent potential security incidents.

Why it matters

CVE-2026-111715 is a missing authorization vulnerability in Arkon's Wiki Graph Neighborhood API, allowing authenticated employees to access other departments' wiki metadata. Defenders should prioritize verifying and remediating this vulnerability, especially in multi-departmental environments.

  • Potential exposure of sensitive wiki metadata
  • Unauthorized access to page slugs, titles, types, and link edges
  • Possible misuse of wiki graph neighborhood API for reconnaissance
  • Verification of authorization checks for wiki metadata access

Technical summary

The vulnerability exists in the GET /api/wiki/graph endpoint, allowing authenticated employees with limited permissions to query get_neighborhood() without scope checks, potentially exposing sensitive wiki metadata. This could allow unauthorized access to page slugs, titles, types, and link edges up to depth 3. Defenders should prioritize verifying and remediating this vulnerability in Arkon deployments, especially in environments with multi-departmental wiki usage. The vulnerability could lead to potential exposure of sensitive information and increase the risk of data breaches.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Arkon deployments, especially in environments with multi-departmental wiki usage.

Recommended defensive actions

  • Verify Arkon version and assess exposure
  • Restrict access to Wiki Graph Neighborhood API
  • Implement proper authorization checks for wiki metadata access
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and advisories. The vulnerability exists in the GET /api/wiki/graph endpoint, allowing authenticated employees with limited permissions to query get_neighborhood() without scope checks. This could lead to potential exposure of sensitive wiki metadata. Defenders should verify and remediate this vulnerability, especially in environments with multi-departmental wiki usage.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111715 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111715

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111715 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111715

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111715.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/wiki.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nduckmink/arkon/blob/v0.9.2/app/services/wiki_service.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/arkon-through-0.9.2-missing-authorization-via-wiki-graph-neighborhood-api

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.