Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getarcaneapp/arcane

              main @ d006d2b
            

Fixes

CVEs

CRITICAL

Peak severity

28.9%

Coverage

Highlights

Auth Bypass: 21 prior fixes. Scrutinize any change in this area.

backend/api/handlers/auth.go: most-fixed (3 issues). Treat as high-risk during review.

35 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: JWT parsing accepted alg=none, allowing unauthenticated token forgery; also OIDC merging and admin role mapping lacked validation.

Auth Bypass: Multiple admin-only endpoints (API keys, file ops, updater, git repos, registries) lacked admin role checks, allowing standard users to perform privileged actions.

Privilege Escalation: Environment access tokens granted sudo (global admin) permissions, and API key creation allowed privilege escalation beyond caller permissions.