Lucene search
K

CVE-2026-45625

๐Ÿ—“๏ธย 29 May 2026ย 17:10:57Reported byย GitHub_MTypeย 
cve
ย cve
๐Ÿ”—ย web.nvd.nist.gov๐Ÿ“ฐ๏ธย 1ย Media mentions๐Ÿ‘ย 18ย Views๐ŸŒ WEB

CVE-2026-45625: Arcane prior to 1.19.0 allows non-admins to exfiltrate Git credentials via git endpoints.

Related
Detection
Affected
Refs
Paths
Social
Vulners
Node
getarcaneapparcaneRange<1.19.0
[
  {
    "vendor": "getarcaneapp",
    "product": "arcane",
    "versions": [
      {
        "version": "< 1.19.0",
        "status": "affected"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
idquery param/api/customize/git-repositoriesGit repo listing endpoint exposed without admin check and permits unauthorized users to access repository configurations.CWE-862
urlrequest body/api/customize/git-repositoriesCreate a git repository configuration without admin authorization, enabling manipulation of credentials and subsequent exfiltration risk.CWE-862
tokenrequest body/api/customize/git-repositoriesCreate a git repository configuration without admin authorization, enabling manipulation of credentials and subsequent exfiltration risk.CWE-862
sshKeyrequest body/api/customize/git-repositoriesCreate a git repository configuration without admin authorization, enabling manipulation of credentials and subsequent exfiltration risk.CWE-862
idpath/api/customize/git-repositories/{id}Get a specific git repository configuration without enforcing admin role.CWE-862
urlrequest body/api/customize/git-repositories/{id}Update a git repository configuration without admin check; potential to trigger credential exposure during tests or fetches.CWE-862
tokenrequest body/api/customize/git-repositories/{id}Update a git repository configuration without admin check; potential to trigger credential exposure during tests or fetches.CWE-862
sshKeyrequest body/api/customize/git-repositories/{id}Update a git repository configuration without admin check; potential to trigger credential exposure during tests or fetches.CWE-862
idpath/api/customize/git-repositories/{id}Delete a git repository configuration without admin authorization.CWE-862
idrequest body/api/customize/git-repositories/{id}/testTest a git repository configuration without admin verification, enabling propagation of credentials during test calls.CWE-862
Rows per page

Data

Build on a solid foundation withย Vulners data

Weย provide theย essential building blocks forย cybersecurity solutions withย comprehensive, structured, andย constantly updated vulnerability andย exploits data

Api

Power your application withย Vulners API

The Vulners REST API offers reliable, high-performance access toย vulnerabilityย intelligence, withย 99.9%ย SLAย uptime andย CDN-backed data delivery forย seamlessย global access

App

Assess and manage vulnerabilities withย Vulnersย tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Jun 2026 10:52Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.19.9
EPSS0.00387
SSVC
18