Vulnerability GO-2026-5561
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 10:34 PM UTC
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.18.1
v1.15.3 - v1.18.1
Summary
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
Details
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
5 hours ago
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-6806
v1.15.3 - v1.20.0 GO-2026-6806
Unknown
5 hours ago
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-6807
v1.15.3 - v1.20.0 GO-2026-6807
Unknown
3 months ago
Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.19.1 GO-2026-5476
v1.15.3 - v1.19.1 GO-2026-5476
Unknown
3 months ago
Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-5292
v1.15.3 - v1.20.0 GO-2026-5292
Unknown
3 months ago
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.19.3 GO-2026-5308
v1.15.3 - v1.19.3 GO-2026-5308
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 10:34 PM UTC
Fixed (v1.19.0)
5 months ago
May 11, 2026 at 06:17 PM UTC
Last Modified
3 months ago
June 25, 2026 at 11:01 PM UTC