Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

🗓️ 18 May 2026 13:44:47Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 15 Views

Missing admin checks on git endpoints lets logged-in users exfiltrate Git credentials.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-45625	29 May 202617:10	–	attackerkb
Circl	CVE-2026-45625	29 May 202620:24	–	circl
CNNVD	arcane 安全漏洞	29 May 202600:00	–	cnnvd
CVE	CVE-2026-45625	29 May 202617:10	–	cve
Cvelist	CVE-2026-45625 Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs	29 May 202617:10	–	cvelist
EUVD	EUVD-2026-33373	29 May 202617:10	–	euvd
NVD	CVE-2026-45625	29 May 202618:17	–	nvd
OSV	CVE-2026-45625 Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs	29 May 202617:10	–	osv
OSV	GHSA-7H26-HG47-P9HX Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs	18 May 202613:44	–	osv
OSV	GO-2026-5220 Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs in github.com/getarcaneapp/arcane/backend	25 Jun 202618:43	–	osv

Vulners

Node

getarcaneapp arcaneRange≤1.18.1go

Source	Link
github	www.github.com/getarcaneapp/arcane/security/advisories/GHSA-7h26-hg47-p9hx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45625
github	www.github.com/advisories/GHSA-7h26-hg47-p9hx

09 Jun 2026 10:30Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.9

EPSS0.00387

SSVC

missing admin checks git repositories credentials exfiltration nine endpoints authentication only http basic exfiltration