Vulnerability Description
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles, severities, statuses, and analyst notes from other tenants.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/archerysec/archerysec
- https://github.com/archerysec/archerysec/blob/v2.0.6/webscanners/views.py#L297-L
- https://github.com/archerysec/archerysec/issues/676
- https://www.vulncheck.com/advisories/archerysec-through-2.0.6-information-disclo
- https://github.com/archerysec/archerysec/issues/676
FAQ
What is CVE-2026-92765?
CVE-2026-92765 is a vulnerability with a CVSS score of 6.5 (MEDIUM). ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can s...
How severe is CVE-2026-92765?
CVE-2026-92765 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92765?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.