Getarcaneapp Arcane vulnerabilities

• getarcaneapp arcane Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) CVE-2026-96627 Fix available 8.8 HighOctober 16, 2026
• getarcaneapp arcane Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` CVE-2026-96628 Fix available 4.3 MediumOctober 16, 2026
• getarcaneapp arcane Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host CVE-2026-96626 8.5 HighOctober 16, 2026
• getarcaneapp arcane Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints CVE-2026-86114 7.1 HighSeptember 5, 2026
• getarcaneapp arcane Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane CVE-2026-47179 Fix available 7.7 HighMay 28, 2026
• getarcaneapp arcane Arcane: Missing admin authorization on global variables endpoint CVE-2026-47125 Fix available 8.8 HighMay 23, 2026
• getarcaneapp arcane Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover CVE-2026-45627 Fix available 8.2 HighMay 18, 2026
• getarcaneapp arcane Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter CVE-2026-45626 6.3 MediumMay 18, 2026
• getarcaneapp arcane Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs CVE-2026-45625 Fix available 9.9 CriticalMay 18, 2026
• getarcane arcane Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) CVE-2026-42461 Fix available 8.7 HighApril 30, 2026
• getarcane arcane Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint CVE-2026-40242 Fix available 7.2 HighApril 10, 2026
• arcane Arcane allows unauthenticated proxy access to remote environments CVE-2026-23944 8.0 HighJanuary 19, 2026
• arcane Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE CVE-2026-23520 Public exploitFix available 9.1 CriticalJanuary 15, 2026
• getarcaneapp arcane WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability CVE-2025-69031 5.3 MediumDecember 30, 2025