CVE-2026-84149 Information Disclosure Vulnerability in Manacle Technologies ERP System
An unauthenticated attacker can access the exposed .git directory to retrieve source code and metadata from the ERP system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84149?
CVE-2026-84149 is a critical vulnerability in Manacle Technologies Multi-tenant ERP System, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.
Weakness: CWE-527
Which versions are affected by CVE-2026-84149?
How do I fix CVE-2026-84149?
No fix has been published for CVE-2026-84149 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84149 being exploited?
There is no known exploitation of CVE-2026-84149 in the wild and no public exploit code.
Sources
Also known as GHSA-mpmp-g8h4-fq2c.