CVE-2026-111717 Details

A missing authorization vulnerability has been identified in Arkon versions through 0.9.2. This vulnerability allows authenticated employees to access skill version metadata from other departments, bypassing the necessary authorization checks. Employees with the default 'skill:read' permission can exploit this vulnerability by sending a GET request to the '/api/skills/{slug}/versions' endpoint for skills belonging to other departments. The response includes sensitive information such as version numbers, hashes, storage paths, and changelogs.

The vulnerability can be fixed by adding the missing authorization checks to the 'list_skill_versions' endpoint. This involves verifying that the user has access to the skill based on their department before returning the version metadata.