The vulnerability stems from a missing authorization check in the /api/wiki/graph endpoint, allowing an authenticated employee with only the wiki:read:own_dept permission to query paging metadata from other departments. When an attacker calls the get_neighborhood API, the response includes slugs, titles, types, and link edges up to a depth of three, exposing a map of cross‑department wiki structure. This information can facilitate further reconnaissance, phishing, or lateral movement, and compromises confidentiality of internal documents visible only to authorized staff. The attack vector is inferred to be HTTP over the internal network, requiring authentication but no elevated privileges beyond the minimal wiki read scope.

Arkon version 0.9.2 released by nduckmink – this is the only affected product and version identified. No other versions are mentioned in the data provided.

The CVSS score of 5.3 indicates a moderate impact, with the vulnerability classified as an information disclosure. The EPSS score is not available, making it unclear how frequently attackers are attempting exploitation; however, the vulnerability is listed as not being in CISA KEV, suggesting limited known exploitation. Attackers only need to be authenticated, and the missing authorization check removes the intended scope restriction, so any user with the wiki:read:own_dept permission can abuse the endpoint within the internal network. Because the data exposed is purely metadata, the overarching risk is moderate rather than critical. Nonetheless, the absence of authorization is a significant flaw deserving attention.