Arcane is a Docker management interface. Before version 1.18.0, four GET endpoints under /api/templates* in Arcane's backend were accessible without any security requirements, allowing unauthenticated users to retrieve full Compose YAML and .env contents of all custom templates. Since the UI saves real environment secrets verbatim in these templates, this missing authorization leads to an unauthenticated read of sensitive operator secrets. All other CRUD operations on these endpoints require authentication, indicating this is a backend authorization oversight. The issue is addressed in Arcane 1.18.0.

Unauthenticated attackers can access sensitive configuration files containing secrets such as database passwords and API keys. This unauthorized read access can lead to compromise of operator credentials and potentially broader system compromise. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Upgrade Arcane to version 1.18.0 or later, where this missing authorization vulnerability is patched. Until then, restrict network access to the vulnerable endpoints to trusted users only. Patch status is not explicitly stated but the vendor has released version 1.18.0 containing the fix, so upgrading is the recommended remediation.