https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 17:09:05 +0000 https://db.gcve.eu/vuln/cve-2026-111717 <p><strong>Affected:</strong> nduckmink arkon</p> <p>Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments&#39; skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department&#39;s skill to obtain version numbers, hashes, storage paths and changelogs.</p> <p><strong>Affected:</strong> nduckmink arkon</p> <p>Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments&#39; skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department&#39;s skill to obtain version numbers, hashes, storage paths and changelogs.</p> https://db.gcve.eu/vuln/cve-2026-111717