PULSE
ES
FEED
ransomn0n reclama a Prafesta Ind. e Com. de Embalagens Ltda · BR · Manufacturingransomplay reclama a WSBI-ESBG · BE · Financial Servicesransomplay reclama a New Tec Tool Limited · HK · Manufacturingransomplay reclama a MicroSearch Corporation · Technologyransomplay reclama a Pure Options · Financial Servicesransomredact reclama a ONEOK, Inc. · US · Energy & Utilitiesransomvexy ransomware reclama a Data-Core Systems · Technologyransomwallstreet reclama a Girl Scouts of Eastern Massachusetts · US · Educationransomn0n reclama a Company #80 · Not Foundransomn0n reclama a Company #79 · US · Not Foundransomn0n reclama a Company #78 · Not Foundransomn0n reclama a Company #77 · US · Not Foundransomn0n reclama a Company #76 · US · Not Foundransomn0n reclama a Company #72 · Not Foundransomn0n reclama a Prafesta Ind. e Com. de Embalagens Ltda · BR · Manufacturingransomplay reclama a WSBI-ESBG · BE · Financial Servicesransomplay reclama a New Tec Tool Limited · HK · Manufacturingransomplay reclama a MicroSearch Corporation · Technologyransomplay reclama a Pure Options · Financial Servicesransomredact reclama a ONEOK, Inc. · US · Energy & Utilitiesransomvexy ransomware reclama a Data-Core Systems · Technologyransomwallstreet reclama a Girl Scouts of Eastern Massachusetts · US · Educationransomn0n reclama a Company #80 · Not Foundransomn0n reclama a Company #79 · US · Not Foundransomn0n reclama a Company #78 · Not Foundransomn0n reclama a Company #77 · US · Not Foundransomn0n reclama a Company #76 · US · Not Foundransomn0n reclama a Company #72 · Not Found
← All CVEs
CVE WatchOct 16, 2026

CVE-2026-111716

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments'

CVSS

5.4

Medium

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-639

EPSS · 30d

Not enough EPSS history yet.

Technical description

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-617268.1 HIG
—
———Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.9hCVE-2026-599637.1 HIG
—
———Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.7hCVE-2026-1117228.1 HIG
—
——0LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.10hCVE-2026-1117215.4 MED
—
——0Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.7hCVE-2026-1117174.3 MED
—
——0Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.10hCVE-2026-1117154.3 MED
—
——0Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.10h