CVE-2026-92765

Name of the Vulnerable Software and Affected Versions ArcherySec versions prior to 2.0.7

Description Authenticated users can read vulnerability findings from other organizations due to a failure to validate organization ownership in the 'WebScanVulnList' endpoint. By supplying arbitrary scan identifiers, an attacker can retrieve complete web vulnerability data from other tenants, including titles, severities, statuses, and analyst notes.

Recommendations Update ArcherySec to version 2.0.7 or later. As a temporary mitigation, restrict access to the 'WebScanVulnList' endpoint to minimize the risk of unauthorized data retrieval.