Arcane allows the registry URL to be updated while the encrypted token is retained. If a user with registry update and test permissions repoints a generic URL and does not supply a new token, the system decrypts the existing token and sends it to the attacker-controlled host during the test operation. This bypasses destination restrictions and effectively exposes the stored personal access token or password, enabling attackers to access or tamper with the container registry.

The vulnerability affects instances of Arcane from getarcaneapp:arcane version 2.4.x and earlier. Versions 2.5.0 and later have the fix implemented.

The CVSS score of 8.5 classifies this as a high-severity flaw. Exploitation requires authenticatable access with the registries:update and registries:test privileges, so it is not a publicly exploitable vector but remains significant for accounts with elevated permissions. No EPSS information is available and the issue has not been listed in the CISA KEV catalog, though the potential for credential theft remains high given the nature of the flaw.