CVE-2026-111716 Details

A broken access control vulnerability has been identified in Arkon versions through 0.9.2. This vulnerability allows authenticated employees to read and modify sources from other departments. The issue arises because certain by-id routes in the sources router bypass the necessary access control checks. As a result, employees can access and manipulate data from foreign sources, including compilation plans and skill version metadata, while also altering the ingestion state of sources from other departments.

The vulnerability can be fixed by adding the missing access control checks to the affected routes. This includes enforcing department scope boundaries on the wiki graph neighborhood, compilation plan, skill versions, and source mutation/status routes. Additionally, every by-id route should be routed through a shared object-access dependency to ensure proper access control is applied.