# CVE-2026-111717: Arkon missing authorization in list_skill_versions

Source: https://junglewise.ai/threats/cve-2026-111717-arkon-through-0-9-2-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111717 · Severity: medium · CVSS 4.3 · Published 2026-10-16

Arkon is an employee skill management system. A missing authorization check in the list_skill_versions endpoint allows authenticated employees to view other departments' skill version information by exploiting inadequate access controls, potentially exposing internal training and capability data across department boundaries.

Technologies: [Nduckmink Arkon](https://junglewise.ai/threats/technologies/arkon). Vendors: [Nduckmink](https://junglewise.ai/threats/vendors/nduckmink).

## Quick answers

**Is CVE-2026-111717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111717 being exploited in the wild.

**How severe is CVE-2026-111717?** Medium severity, with a CVSS score of 4.3, published 16 October 2026.

**Which products and versions are affected?** Nduckmink Arkon through 0.9.2.

**Is there a fix for CVE-2026-111717?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111717 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111717?** Check whether you run Nduckmink Arkon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The list_skill_versions endpoint in Arkon's skills router fails to enforce the can_access_skill authorization check before returning version metadata. An authenticated user with the default skill:read permission can bypass departmental access controls by directly requesting GET /api/skills/{slug}/versions for another department's skill, obtaining version numbers, hashes, storage paths, and changelogs. The vulnerability exists in versions up to 0.9.2.

## Affected products

- nduckmink Arkon through 0.9.2

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py](https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py)
- [https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py](https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py)

## Related threats

- [Arkon broken access control in document routes](https://junglewise.ai/threats/cve-2026-111716-arkon-through-0-9-2-contains-a-broken-access-control)
- [Arkon missing authorization in GET /api/wiki/graph](https://junglewise.ai/threats/cve-2026-111715-arkon-through-0-9-2-contains-a-missing-authorization)