CVE-2026-47125

🗓️ 29 May 2026 17:07:21Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 14 Views🌐 WEB

Missing admin authorization on Arcane global variables endpoint lets non-admins overwrite global environment, impacting all projects.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-47125	29 May 202617:07	–	attackerkb
Circl	CVE-2026-47125	29 May 202619:00	–	circl
CNNVD	arcane 安全漏洞	29 May 202600:00	–	cnnvd
Cvelist	CVE-2026-47125 Arcane: Missing admin authorization on global variables endpoint	29 May 202617:07	–	cvelist
EUVD	EUVD-2026-33370	29 May 202617:07	–	euvd
Github Security Blog	Arcane: Missing admin authorization on global variables endpoint	23 May 202600:16	–	github
NVD	CVE-2026-47125	29 May 202618:17	–	nvd
OSV	GHSA-JPJH-JM2P-39HH Arcane: Missing admin authorization on global variables endpoint	23 May 202600:16	–	osv
Positive Technologies	PT-2026-42873	23 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-47125	1 Jun 202622:03	–	redhatcve

Vulners

Node

getarcaneapp arcaneRange<1.19.2

[
  {
    "vendor": "getarcaneapp",
    "product": "arcane",
    "versions": [
      {
        "version": "< 1.19.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/getarcaneapp/arcane/security/advisories/GHSA-jpjh-jm2p-39hh

Parameter	Position	Path	Description	CWE
variables	request body	/api/environments/{id}/templates/variables	Missing admin authorization check on the endpoint allows any authenticated non-admin user to overwrite system-wide environment variables used for project deployments.	CWE-862

29 May 2026 20:25Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.8

EPSS0.00044

SSVC

CWE-862