CVE-2026-92765— ArcherySec 2.0.6 前 WebScanVulnList 信息泄露漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

archerysec archerysec

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vu

CVE-2026-92765 影响 archerysec archerysec。尚无明确在野利用证据，仍需结合暴露面评估。ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizati CVE-2026-92765 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2026-92765

一、 漏洞 CVE-2026-92765 基础信息

受影响产品

二、漏洞 CVE-2026-92765 的公开POC

三、漏洞 CVE-2026-92765 的情报信息

CVE-2026-92765 其他参考 (4)

• GitHub - archerysec/archerysec: ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec. · GitHub product
• Cross-organization IDOR in WebScanVulnList lets any authenticated user read another organization's web vulnerability findings by scan_id · Issue #676 · archerysec/archerysec issue-tracking
• archerysec/webscanners/views.py at v2.0.6 · archerysec/archerysec · GitHub technical-description
• ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList | Advisories | VulnCheck third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-92765

IV. Related Vulnerabilities

V. Comments for CVE-2026-92765