CVE-2026-47125 is a missing authorization vulnerability (CWE-862) in the Arcane application before version 1.19.2. The affected endpoint PUT /api/environments/{id}/templates/variables allows authenticated non-admin users to overwrite the .env.global file, which is merged into every project's Docker compose file. This can lead to supply-chain attacks by redirecting image pulls to attacker-controlled registries, exfiltration of sensitive database credentials, and disruption of all projects relying on these environment variables. The CVSS 3.1 score is 8.8 (high severity) with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The vulnerability is fixed in version 1.19.2.

An attacker with any authenticated non-admin access can overwrite global environment variables used by all projects, enabling supply-chain remote code execution on the Docker host, credential theft, and widespread disruption of container deployments. This compromises confidentiality, integrity, and availability of the affected systems.

Upgrade Arcane to version 1.19.2 or later, where this missing authorization check vulnerability is fixed. Until then, restrict access to authenticated users carefully and monitor for unauthorized changes to environment variables. Patch status is confirmed fixed in 1.19.2.