CVE-2026-111715 Details

A missing authorization vulnerability has been identified in Arkon versions through 0.9.2. This vulnerability allows authenticated employees with the 'wiki:read:own_dept' permission to access wiki metadata from other departments. By supplying a foreign slug to the 'GET /api/wiki/graph' endpoint, these employees can bypass scope checks and retrieve page slugs, titles, types, and link edges up to a depth of three. The vulnerability arises because the 'get_neighborhood()' function, which handles the graph traversal, does not enforce the necessary scope restrictions, leading to unauthorized cross-department data access.

The vulnerability can be fixed by adding scope checks to the 'GET /api/wiki/graph' endpoint and ensuring that the 'get_neighborhood()' function applies the appropriate scope filters. Additionally, the same checks should be implemented on related endpoints that currently lack them.