CVE-2026-92765

CVE-2026-92765 is an organization-ownership validation flaw (CWE-639, broken object-level authorization) in the WebScanVulnList endpoint of ArcherySec, an open-source vulnerability assessment and management platform. An authenticated user can supply arbitrary scan identifiers belonging to a different organization, and the endpoint returns the results without checking tenant ownership. This lets the attacker read complete web vulnerability records from other tenants, including titles, severities, statuses, and analyst notes, though no write or availability impact is involved. Any multi-tenant deployment of ArcherySec up to and including version 2.0.6 is affected, with the greatest risk where low-privileged accounts exist across tenant boundaries or where the instance is internet-facing. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; the issue was assigned by the VulnCheck CNA.

What to do: Upgrade ArcherySec to the latest release (any version newer than 2.0.6) once a patched build is available, since the flaw affects everything through 2.0.6. In the meantime, restrict access to WebScanVulnList at the reverse proxy or API-gateway layer, minimize the number of authenticated accounts (especially low-privileged ones in multi-tenant setups), and review access logs for requests enumerating scan IDs outside the user's own organization. If the instance is internet-exposed, limit it to trusted networks or VPN access.