Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92765ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in archerysec from archerysec. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles, severities, statuses, and analyst notes from other tenants.

Affected products (as reported)

Vendor	Product	Versions
archerysec	archerysec	0 – through 2.0.6

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #676 issue-tracking
https://github.com/archerysec/archerysec product
WebScanVulnList filters on scan_id with no organization predicate technical-description
VulnCheck Advisory: ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList third-party-advisory