Vulnerability · Published Oct 16, 2026 · Assigned by GitHub_M
CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
High 8.8
In plain English
A high-severity privilege mismanagement in arcane from getarcaneapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/getarcaneapp/arcane/backend | no fix listed | GO-2026-6807 |
| Go | github.com/getarcaneapp/arcane/backend/v2 | 2.6.0 | GHSA-pw5q-rjx4-7f7p |
| Go | github.com/getarcaneapp/arcane/backend/v2 | 2.6.0 | GO-2026-6807 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| getarcaneapp | arcane | < 2.6.0 |
Weakness: CWE-266, CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p x_refsource_CONFIRM
- https://github.com/getarcaneapp/arcane/pull/3426 x_refsource_MISC
- https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1 x_refsource_MISC
- https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0 x_refsource_MISC