Executive brief
ArcherySec is a vulnerability management and application security platform used to track and manage web application security findings across multiple customer organizations. A flaw in the WebScanVulnList endpoint fails to validate that authenticated users only access findings from their own organization, allowing any logged-in user to view sensitive vulnerability details (titles, severities, statuses, and notes) from other tenants by supplying arbitrary scan IDs.
Technical details
The vulnerability is an authorization bypass (broken access control) in the WebScanVulnList API endpoint. The vulnerable component fails to perform organization ownership validation before returning web vulnerability scan results. An authenticated attacker can exploit this by crafting requests with arbitrary scan identifiers to retrieve complete vulnerability data from other organizations. The vulnerability requires valid authentication (precondition: attacker must have valid credentials) and is reachable over the network via the REST API. Patches are expected in versions after 2.0.6.
Affected products
- ArcherySec ArcherySec through 2.0.6
Timeline
- 2026-09-16: disclosed