Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Arcane allows unauthenticated proxy access to remote environments

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane: Missing admin authorization on global variables endpoint

Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host

Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover

Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE

Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint

Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`