CVE-2026-47125 is a missing authorization vulnerability (CWE-862) in the Arcane interface for Docker management. Specifically, before version 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint lacks an admin authorization check, allowing any authenticated non-admin user to overwrite the global environment variables file (.env.global). This file is merged into every project's Docker compose file, so malicious changes can affect all deployments. Attackers can manipulate variables such as REGISTRY, IMAGE, DATABASE_URL, or SECRET_KEY to redirect image pulls to attacker-controlled registries, exfiltrate sensitive credentials, or disrupt all projects. The vulnerability has a CVSS 3.1 score of 8.8 (high severity).

An attacker with any authenticated non-admin access can overwrite global environment variables used by all projects, leading to potential supply-chain remote code execution on the Docker host, credential exfiltration, and widespread disruption of project deployments. The impact affects confidentiality, integrity, and availability at a high level.

This vulnerability is fixed in Arcane version 1.19.2. Users should upgrade to version 1.19.2 or later to ensure the admin authorization check is enforced on the affected endpoint. No official patch link was provided, but upgrading to the fixed version is the recommended remediation. Since this is not a cloud service, remediation depends on user action.