Arcane’s endpoint for updating global template variables is exposed without requiring admin authorization. Any authenticated non‑admin user can send a PUT request to the /api/environments/{id}/templates/variables URL, causing the application to overwrite the system‑wide .env.global file. Because these variables are substituted into every project’s Docker compose file, an attacker can change values such as REGISTRY, IMAGE, DATABASE_URL or SECRET_KEY. The resulting modifications can redirect image pulls to malicious registries, enabling supply‑chain remote code execution on the Docker host, leak database credentials, or cause widespread service disruption.

The vulnerability affects the Arcane application developed by getarcaneapp. Versions prior to 1.19.2 are impacted; versions 1.19.2 and later contain the fix that properly enforces admin checks on the PUT /api/environments/{id}/templates/variables endpoint.

The CVSS score is 8.8, indicating a high‑severity flaw. The EPSS score is not available, but the absence of a KEV listing suggests no known public exploits as of now. However, the flaw can be exploited by any authenticated user who is not an administrator, making the attack vector local to the application’s API. Because the vulnerability allows modification of configuration files that are shared across all deployments, it has widespread impact on confidentiality, integrity, and availability for all users of the affected Arcane instance.