CVE-2026-96627 Details
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
A vulnerability in Arcane prior to version 2.6.0 allows users with delegated 'users:update' permission to reset the password of a global administrator, leading to complete account takeover. The issue arises because the 'UpdateUser' function in 'backend/api/handlers/users.go' does not verify the privilege level of the user making the request before changing the password. This flaw enables a manager to overwrite the admin password and log in as that administrator.
Users can update to Arcane version 2.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1 | [email protected] | Source CodeVendor |
| https://github.com/getarcaneapp/arcane/pull/3426 | [email protected] | Issue TrackingVendor |
| https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0 | [email protected] | Source CodeVendor |
| https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Arcane | <= 2.5.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |