CVE-2026-45625

🗓️ 29 May 2026 17:10:57Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 87 Views🌐 WEB

CVE-2026-45625: Arcane prior to 1.19.0 allows non-admins to exfiltrate Git credentials via git endpoints.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-45625	29 May 202617:10	–	attackerkb
Circl	CVE-2026-45625	29 May 202620:24	–	circl
CNNVD	arcane 安全漏洞	29 May 202600:00	–	cnnvd
Cvelist	CVE-2026-45625 Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs	29 May 202617:10	–	cvelist
EUVD	EUVD-2026-33373	29 May 202617:10	–	euvd
Github Security Blog	Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs	18 May 202613:44	–	github
NVD	CVE-2026-45625	29 May 202618:17	–	nvd
OSV	GHSA-7H26-HG47-P9HX Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs	18 May 202613:44	–	osv
OSV	GO-2026-5220 Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs in github.com/getarcaneapp/arcane/backend	25 Jun 202618:43	–	osv
OSV	OPENSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb	30 Jul 202609:09	–	osv

Vulners

Node

getarcane arcaneRange<1.19.0

[
  {
    "vendor": "getarcaneapp",
    "product": "arcane",
    "versions": [
      {
        "version": "< 1.19.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/getarcaneapp/arcane/security/advisories/GHSA-7h26-hg47-p9hx

Parameter	Position	Path	Description	CWE
url	nested	/api/customize/git-repositories	Endpoints under /api/customize/git-repositories are exposed without admin checks, allowing non-admin users to list/create/get/update/delete/test/browseFiles/listBranches git repositories and exfiltrate credentials via subsequent /test, /branches, or /files calls.	CWE-862
token	nested	/api/customize/git-repositories	Endpoints under /api/customize/git-repositories are exposed without admin checks, allowing non-admin users to list/create/get/update/delete/test/browseFiles/listBranches git repositories and exfiltrate credentials via subsequent /test, /branches, or /files calls.	CWE-862
sshKey	nested	/api/customize/git-repositories	Endpoints under /api/customize/git-repositories are exposed without admin checks, allowing non-admin users to list/create/get/update/delete/test/browseFiles/listBranches git repositories and exfiltrate credentials via subsequent /test, /branches, or /files calls.	CWE-862
url	nested	/api/git-repositories/sync	Endpoints under /api/git-repositories/sync are exposed without admin checks, allowing non-admin users to list/create/get/update/delete/test/browseFiles git repositories and exfiltrate credentials via subsequent /test, /branches, or /files calls.	CWE-862
token	nested	/api/git-repositories/sync	Endpoints under /api/git-repositories/sync are exposed without admin checks, allowing non-admin users to list/create/get/update/delete/test/browseFiles git repositories and exfiltrate credentials via subsequent /test, /branches, or /files calls.	CWE-862
sshKey	nested	/api/git-repositories/sync	Endpoints under /api/git-repositories/sync are exposed without admin checks, allowing non-admin users to list/create/get/update/delete/test/browseFiles git repositories and exfiltrate credentials via subsequent /test, /branches, or /files calls.	CWE-862

21 Jul 2026 15:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.9

EPSS0.00387

SSVC

CWE-862