CVE-2026-84149: CWE-527 Exposure of Version-Control repository to an unauthorized control sphere in Manacle Technologies Multi-tenant ERP System

This vulnerability arises from the public accessibility of the .git directory in the Manacle Technologies Multi-tenant ERP System. An unauthenticated attacker can retrieve repository metadata and associated files from this exposed directory, which may enable reconstruction of the application's source code. The issue is classified under CWE-527 (Exposure of Version-Control repository to an unauthorized control sphere). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and security controls. The vulnerability is published and assigned CVE-2026-84149 but lacks vendor-provided remediation details.

An attacker exploiting this vulnerability can gain access to sensitive repository information, including source code and metadata, which could lead to further attacks such as code analysis, discovery of additional vulnerabilities, or intellectual property theft. The high CVSS score reflects the critical nature of the confidentiality and security control impacts. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict public access to the .git directory by configuring the web server to deny access or removing the directory from publicly accessible locations. Monitor vendor communications for updates on patches or official mitigations.