nduckmink CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM nduckmink CVE published 2026-10-16

CVE-2026-111716

CVE-2026-111716 is a broken access control vulnerability in Arkon through version 0.9.2. Authenticated employees can read and modify other departments' sources due to by-id routes in app/routers/sources.py skipping can_access_document checks. This allows disclosure of derived wiki titles and summaries and alteration of ingestion state. The vulnerability exists because the can_access_document check is bypa [truncated]