github.com/getarcaneapp/arcane/backend vulnerabilities (Go)
10 vulnerabilities.
-
github.com/getarcaneapp/arcane/backendGo Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) 8.8 High -
github.com/getarcaneapp/arcane/backendGo Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` 4.3 Medium -
github.com/getarcaneapp/arcane/backendGo Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane 7.7 High -
github.com/getarcaneapp/arcane/backendGo Arcane: Missing admin authorization on global variables endpoint 8.8 High -
github.com/getarcaneapp/arcane/backendGo Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover 8.2 High -
github.com/getarcaneapp/arcane/backendGo Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter 6.3 Medium -
github.com/getarcaneapp/arcane/backendGo Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs 9.9 Critical -
github.com/getarcaneapp/arcane/backendGo Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) 8.7 High -
github.com/getarcaneapp/arcane/backendGo Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint 7.2 High -
github.com/getarcaneapp/arcane/backendGo Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE 9.1 Critical