CVE-2026-92765 in ArcherySec
Summary
by MITRE • 09/16/2026
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles, severities, statuses, and analyst notes from other tenants.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability represents a critical failure in access control mechanisms within the ArcherySec application, specifically affecting versions up through 2.0.6. This flaw is categorized as an Insecure Direct Object Reference, commonly known by its CWE identifier CWE-639. The core technical issue lies in the WebScanVulnList endpoint, which processes requests to retrieve vulnerability scan results but fails to adequately validate whether the authenticated user initiating the request has legitimate ownership or authorized access rights over the specific organization associated with the requested data. In a properly secured multi-tenant architecture, every API call involving organizational resources must verify that the session context matches the permissions of the requesting entity relative to the target resource identifier.
By exploiting this logic error, an authenticated attacker can manipulate input parameters to supply arbitrary scan identifiers or organization IDs that do not belong to their own tenant. The application processes these requests without performing sufficient authorization checks against the backend database records linking users to organizations. Consequently, the system returns sensitive vulnerability findings belonging to other tenants. This includes detailed technical data such as vulnerability titles, severity ratings, current status indicators, and potentially confidential analyst notes or remediation suggestions provided by security teams.
The operational impact of this vulnerability is severe due to its potential for widespread information disclosure across multiple organizations using the platform. Attackers can systematically enumerate valid identifiers to harvest comprehensive web application vulnerability reports from competitors or other clients. This exposure provides adversaries with a detailed map of an organization's security posture, including known weaknesses and their severity levels. Such intelligence is highly valuable for planning further attacks, as it allows threat actors to target specific unpatched vulnerabilities that are already identified by the victim's internal security team but may not yet be remediated in production environments.
This behavior aligns with several tactics within the MITRE ATT&CK framework, primarily Information Collection under the T1504 category and potentially Data from Information Repositories if the analyst notes contain proprietary methodologies or sensitive architectural details. The vulnerability facilitates unauthorized access to security-sensitive data, which can lead to reputational damage, regulatory non-compliance depending on the industry sector, and increased risk of successful exploitation against exposed assets.
Mitigation strategies must focus on implementing robust authorization checks at the application logic layer. Developers should ensure that every request to retrieve organizational or scan-specific data includes a verification step confirming that the authenticated user's account is explicitly linked to the organization ID referenced in the request parameters. This can be achieved by maintaining strict foreign key relationships between users and organizations in the database schema and enforcing these constraints within the API handler logic before any data retrieval occurs. Additionally, implementing rate limiting on this endpoint may help mitigate automated enumeration attacks while longer-term fixes are deployed. Organizations running affected versions should immediately upgrade to a patched release or apply vendor-provided patches that address this access control bypass.