The Arkon application through version 0.9.2 suffered from a missing authorization flaw in the list_skill_versions endpoint. The vulnerability allows any authenticated user who holds the default skill:read permission to read the version metadata of skills belonging to a different department. This metadata includes version numbers, hashes, storage paths, and changelogs, providing the attacker with detailed insight into the internal structure and evolution of departmental skill assets. The weakness corresponds to CWE-639: Authorization Bypass Through User-Controlled Key.

Affected systems are Arkon deployments utilizing version 0.9.2 or earlier. The flaw is present in the list_skill_versions handler within app/routers/skills.py. At the time of this advisory the product is maintained by the vendor nduckmink under the Arkon code repository, and the specific vulnerability is documented in the supplied GitHub references. No additional vendor version ranges are listed, so all installations of 0.9.2 or older are considered vulnerable unless the endpoint has been overridden or patched independently.

The CVSS score of 5.3 indicates a moderate impact as defined by the AV,B,I,D scoring. EPSS is not available, so no quantifiable exploitation probability is present, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is an authenticated internal user or compromised account with the basic skill:read permission. Once accessed, the attacker can enumerate and study the skill version history across departments, potentially enabling further reconnaissance or social engineering attacks. While the vulnerability does not grant arbitrary code execution or privilege escalation, the exposed metadata could aid in planning targeted attacks against the system.