CVE-2026-92765: ArcherySec Information Disclosure Flaw

CVE-2026-92765 Overview

ArcherySec through version 2.0.6 contains an insecure direct object reference (IDOR) vulnerability in the WebScanVulnList endpoint. The application fails to validate organization ownership when serving vulnerability findings, enabling authenticated users to retrieve scan data belonging to other tenants. By supplying arbitrary scan identifiers, an attacker can enumerate web vulnerability records across organizational boundaries. Exposed data includes finding titles, severity ratings, remediation statuses, and analyst notes. The flaw maps to [CWE-639: Authorization Bypass Through User-Controlled Key] and breaks multi-tenant isolation in a security tool used to track sensitive vulnerability intelligence.

Critical Impact
Any authenticated ArcherySec user can read complete web vulnerability findings from other organizations, including titles, severities, statuses, and analyst notes.

Affected Products

ArcherySec versions through 2.0.6
ArcherySec WebScanVulnList endpoint in webscanners/views.py
Multi-tenant ArcherySec deployments

Discovery Timeline

2026-09-16 - CVE CVE-2026-92765 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92765

Vulnerability Analysis

ArcherySec is an open-source vulnerability management platform that aggregates findings from web, network, and static analysis scanners. The WebScanVulnList view returns web scan findings filtered by a scan identifier supplied in the request. In releases up to and including 2.0.6, the view queries the finding database using only the user-supplied scan ID and does not cross-check the requesting user's organization against the scan's owning organization.

Authenticated users can therefore request findings tied to scan identifiers created by any other tenant. The response includes the full record set: vulnerability titles, severity classifications, remediation statuses, and free-text analyst notes. In shared-hosting or SaaS deployments, this collapses tenant isolation and leaks the security posture of unrelated organizations.

Root Cause

The root cause is a missing authorization check between the authenticated principal and the requested resource. The endpoint treats successful authentication as sufficient and trusts the scan identifier as a legitimate scoping key. No comparison is made between the scan's organization foreign key and the user's organization membership before results are returned. The relevant logic sits in webscanners/views.py around lines 297-313 of the 2.0.6 release, referenced in the VulnCheck Advisory for ArcherySec.

Attack Vector

Exploitation requires only low-privileged authenticated access to the ArcherySec instance over the network. An attacker enumerates or guesses scan identifiers and issues requests to the WebScanVulnList endpoint. Because scan IDs are typically sequential or UUID values referenced elsewhere in the application, discovery is straightforward. The server responds with vulnerability data belonging to the target organization without raising an authorization error. No user interaction, elevated privileges, or exploitation tooling is required. See the GitHub Source Code Snippet for the vulnerable function and GitHub Issue #676 for the upstream report.

Detection Methods for CVE-2026-92765

Indicators of Compromise

Access log entries showing a single authenticated account requesting WebScanVulnList with many distinct scan identifiers in a short time window.
Requests to the endpoint referencing scan IDs that were not created by the requesting user's organization.
HTTP 200 responses returning vulnerability records for scans absent from the user's own dashboard history.

Detection Strategies

Instrument the WebScanVulnList view to log the requesting user, their organization, and the owning organization of the requested scan, then alert on mismatches.
Baseline normal per-user scan access patterns and flag deviations such as sequential ID enumeration or high-cardinality scan ID access.
Review web application firewall logs for repeated POST or GET requests to the vulnerable endpoint with iterating identifier parameters.

Monitoring Recommendations

Forward ArcherySec application and access logs to a centralized logging platform for correlation and long-term retention.
Enable database query auditing for tables backing web scan findings to identify cross-tenant reads.
Monitor authentication events for newly created or dormant accounts that suddenly begin querying vulnerability data at volume.

How to Mitigate CVE-2026-92765

Immediate Actions Required

Restrict network access to the ArcherySec application to trusted administrators until a fixed release is deployed.
Audit user accounts and revoke access for any account that does not require it, reducing the pool of principals able to reach the endpoint.
Review historical access logs for the WebScanVulnList endpoint to identify potential cross-tenant data access.

Patch Information

At publication, ArcherySec versions through 2.0.6 are affected and no fixed release is referenced in the NVD entry. Track the GitHub ArcherySec Project and GitHub Issue #676 for a patched version and apply it once available. Any fix must enforce that the requesting user's organization matches the owning organization of the requested scan before returning findings.

Workarounds

Operate ArcherySec as a single-tenant deployment per organization to eliminate cross-tenant exposure.
Place the application behind an authenticating reverse proxy that restricts access by source IP or SSO group.
Apply a local source patch that adds an organization ownership check to the WebScanVulnList view, using the snippet at lines 297-313 of webscanners/views.py as the modification target.

bash

# Example reverse-proxy allowlist enforcing per-organization access
# nginx location block restricting the vulnerable endpoint
location /webscanners/webscan_vuln_list {
    allow 10.0.0.0/24;   # internal security team subnet
    deny  all;
    proxy_pass http://archerysec_upstream;
}