What is the CVSS score of CVE-2026-84149?

CVE-2026-84149 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-84149?

Within 24 hours: immediately rotate all hardcoded credentials, API keys, and database passwords exposed in source code; isolate Manacle ERP instances from production networks or implement strict access controls; begin forensic analysis of access logs for unauthorized activity. Within 7 days: contact Manacle Technologies for remediation timeline; notify all tenants of exposure scope; inventory sensitive data housed within the system. Within 30 days: complete security assessment of remaining ERP infrastructure; if Manacle Technologies does not release a security update within 30 days, initiate procurement and migration planning to transition to an alternative ERP solution.

Manacle ERP CVE-2026-84149

EUVD-2026-69059 CRITICAL

Exposure of Version-Control Repository to an Unauthorized Control Sphere (CWE-527)

2026-09-01 CERT-In

GHSA-mpmp-g8h4-fq2c

Information Disclosure Multi Tenant Erp System Manacle Technologies

9.2

CVSS 4.0 · Vendor: CERT-In

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Scan ERP host for /.git/HEAD
Delivery

Confirm exposed repository metadata
Exploit

Recursively dump .git objects with git-dumper
Execution

Reconstruct full source and history
Persist

Extract hardcoded secrets and logic
Impact

Reuse credentials to access tenant data

Vulnerability Assessment

Weakness	CWE CWE-527
Exploitation Conditions	Exploitation requires only that the ERP web server expose the .git directory under the public web root - i.e., the application was deployed by cloning/pulling into the served directory rather than deploying built artifacts, and no server rule blocks /.git access. Given the CVSS AV:N/AC:L/PR:N/UI:N metrics, no authentication, user interaction, or special client configuration is needed; the single limiting factor is the server-side deployment condition of a reachable .git folder. Value of the leak is further shaped by whether secrets were actually committed to the repository history.
Impact	The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H) scores 9.2 and correctly captures easy, unauthenticated, network-based exploitation with no user interaction, but the SC:H (subsequent-system confidentiality) contribution that pushes it to CRITICAL is debatable for what is fundamentally an information-disclosure issue; a CVSS 3.1 mapping lands closer to 7.5 (High) with confidentiality-only impact and no integrity/availability effect. No EPSS score, POC flag, or KEV status was supplied, so probabilistic exploitation signals are absent - however, .git exposure is one of the most commonly automated web-scanning findings, so real-world exploitability is high in practice even without a formal POC. The primary risk is second-order: leaked source frequently contains credentials and keys that convert a disclosure into full compromise, so this should be prioritized despite being 'only' an information leak.
Exploit ScenarioDerived	An unauthenticated attacker scanning ERP hosts requests https://target/.git/HEAD, confirms it returns valid Git data, then runs git-dumper to reconstruct the full repository. They grep the recovered source and commit history for database passwords, JWT signing keys, and third-party API tokens, using those secrets to authenticate to the multi-tenant backend and access other tenants' data.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.

RemediationAI

No vendor-released patch version was identified at time of analysis; consult CERT-In advisory CIVN-2026-0430 (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430) for vendor guidance. The most effective fix is to stop serving the .git directory: remove the .git folder from the deployed web root entirely (deploy build artifacts rather than a live working tree), or add a web-server rule to deny all requests to /.git (e.g. an Nginx 'location ~ /\.git { deny all; return 404; }' block or Apache '<DirectoryMatch "/\.git">Require all denied</DirectoryMatch>'), noting this blocks legitimate in-place git operations on the server. Because source and history may already be leaked, also rotate any credentials, API keys, tokens, or certificates that were committed to the repository, since blocking access does not undo prior exposure.

Affected VersionsENISA

Multi-tenant ERP System version

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw stems from serving the application's Git working tree over HTTP, so requests to /.git/ (and objects such as /.git/config, /.git/HEAD, and the packed-refs/objects store) return version-control artifacts instead of being blocked. This maps to CWE-527, Exposure of Version-Control Repository to an Unauthorized Control Sphere. The affected product per the CPE is cpe:2.3:a:manacle_technologies:multi-tenant_erp_system, a multi-tenant enterprise resource planning web application. Standard tools like git-dumper, GitTools, or a recursive object fetch can rebuild the entire commit tree from the exposed loose/packed objects, yielding original source, prior revisions, and any secrets committed to history.

Know when Multi Tenant Erp System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CERT-In) PRIMARY 9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

vuln.today AI 7.5 HIGH

Unauthenticated network fetch of the .git directory with no user interaction gives AV:N/AC:L/PR:N/UI:N; source disclosure is confidentiality-only (C:H, I:N, A:N) with no scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-In).

CVSS VectorVendor: CERT-In

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

High

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.

Executive ViewAI

Why It Matters

Manacle Technologies' Multi-Tenant ERP System leaks complete source code, hardcoded credentials, API keys, and database schemas through an exposed version-control directory, accessible to unauthenticated remote attackers. While no public exploit identified at time of analysis, the vulnerability is trivially exploitable using standard tools and compromises the security posture of all tenant organizations. Every user of this system must assume complete loss of application-level confidentiality and treat all embedded secrets and business logic as exposed.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: remove or restrict network access to .git and version-control directories; enforce multi-factor authentication on all ERP administrative and data-access accounts; implement continuous monitoring for unauthorized data access; deploy Web Application Firewall rules blocking .git enumeration; consider temporary suspension of non-critical ERP functions pending vendor remediation.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

Low

niche India-focused vendor ERP, limited enterprise footprint

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.