PT-2026-116116 · Nduckmink · Arkon
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Arkon through 0.9.2 contains a missing authorization vulnerability in list skill versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can access skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Arkon