Skip to content
OpenAdvisories

Package · Go

github.com/getarcaneapp/arcane/backend

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-96627

    Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:updat…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend github.com/getarcaneapp/arcane/backend/v2 Go
  • High 8.2
    CVE-2026-45627

    Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go
  • High 8.8
    CVE-2026-47125

    Arcane: Missing admin authorization on global variables endpoint

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go
  • High 7.7
    CVE-2026-47179

    Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-trave…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go
  • High 8.7
    CVE-2026-42461

    Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under /api/templates* in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated netw…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go
  • High 7.2
    CVE-2026-40242

    Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go