Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86114Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

Medium 6.5

In plain English

A medium-severity missing authorization in arcane from getarcaneapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.

Affected products (as reported)

Vendor	Product	Versions
getarcaneapp	arcane	1.19.1 – before 2.0.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Researcher write-up technical-description
Template mutations registered without RequireAdmin technical-description
feat: full rbac permissions (#2724) patch
arcane v2.0.0 Release Notes release-notes
https://github.com/getarcaneapp/arcane product
VulnCheck Advisory: Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints third-party-advisory