CVE-2026-92765— ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList

Quick assessment

Copy summary Copy citation

Affected

archerysec archerysec

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vu

CVE-2026-92765 affects archerysec archerysec. No confirmed in-the-wild exploitation; assess based on exposure. ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizati CVE-2026-92765 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-92765

I. Basic Information for CVE-2026-92765

Affected Products

II. Public POCs for CVE-2026-92765

III. Intelligence Information for CVE-2026-92765

Other References for CVE-2026-92765 (4)

• GitHub - archerysec/archerysec: ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec. · GitHub product
• Cross-organization IDOR in WebScanVulnList lets any authenticated user read another organization's web vulnerability findings by scan_id · Issue #676 · archerysec/archerysec issue-tracking
• archerysec/webscanners/views.py at v2.0.6 · archerysec/archerysec · GitHub technical-description
• ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList | Advisories | VulnCheck third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-92765

IV. Related Vulnerabilities

V. Comments for CVE-2026-92765