CVE-2026-111717 nduckmink CVE debrief

Who should care

Defenders and security teams responsible for Arkon deployments should assess their exposure and verify the skill:read permission configuration. They should also review and update the Arkon version to ensure it is not vulnerable. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-111717 is a missing authorization vulnerability in Arkon through version 0.9.2, affecting the list_skill_versions API. This allows authenticated employees with default skill:read permission to read skill version metadata from other departments by bypassing the can_access_skill check. Defenders should prioritize verifying the skill:read permission configuration and ensuring proper authorization checks are in place for the affected API endpoint.

• Authenticated employees may be able to read skill version metadata from other departments
• Defenders need to verify the skill:read permission configuration and ensure proper authorization checks

Technical summary

The vulnerability is caused by a missing authorization check in the list_skill_versions API, allowing authenticated employees to read skill version metadata from other departments. The affected version is Arkon through 0.9.2. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Defenders should prioritize verifying the skill:read permission configuration and ensuring proper authorization checks are in place for the affected API endpoint.

Defensive priority

Defenders should prioritize verifying the skill:read permission configuration and ensuring proper authorization checks are in place for the affected API endpoint.

Recommended defensive actions

• Verify the skill:read permission configuration for authenticated employees
• Ensure proper authorization checks are in place for the affected API endpoint
• Review and update the Arkon version to ensure it is not vulnerable
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in Arkon version 0.9.2. The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. The source item provides details on the vulnerability. The vulnerability allows authenticated employees to read skill version metadata from other departments. The affected version is Arkon through 0.9.2. The CVE record was published on 2026-10-16T17:40:05.568Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.