CVE-2026-96627

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Summary

A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation.

Root Cause

UpdateUser (handler backend/api/handlers/users.go:317-323) loads the target by ID and sets userModel.PasswordHash from the request body for any user, then userService.UpdateUser (user_service.go:174) simply tx.Saves — with NO actor-vs-target privilege comparison. The only IsGlobalAdmin guard (user_service.go:345) is a last-admin check inside DeleteUser, not the update path. Role assignment / role CRUD are RequireGlobalAdmin (backend/pkg/authz/permissions.go:27-33), proving users:update is intended below admin.

Impact

Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated users:update permission.

Proof of Concept

1. Admin delegates a custom "User Manager" role with users:update.
2. PUT /users/{adminId} with {"password":"attacker123"}.
3. POST /auth/login {"username":"arcane","password":"attacker123"} → admin session.

Attack Chain

1. Action: admin delegates custom role with users:update. Guard: role creation is RequireGlobalAdmin. Bypass: intended delegation (holder is meant to manage profiles, not seize admin).
2. Action: PUT /users/{adminId} {"password":"attacker123"}. Guard: RequirePermission(users:update) (users.go:154). Bypass: holder has it; no hierarchy check (users.go:317-323, user_service.go:174 unconditional Save).
3. Action: POST /auth/login as admin → admin session.

Bypass Evidence

• users.go:317-323 sets PasswordHash for any target; user_service.go:174-194 has no actor/target privilege comparison.
• Only IsGlobalAdmin hits are DeleteUser's last-admin guard and DTO flags (grep).
• users:update is org-level, held by no built-in non-admin role (permissions.go:24).

Affected Versions

<= 2.5.0.

Reported by zx (Jace) — GitHub: @manus-use

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Summary

A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation.

Root Cause

UpdateUser (handler backend/api/handlers/users.go:317-323) loads the target by ID and sets userModel.PasswordHash from the request body for any user, then userService.UpdateUser (user_service.go:174) simply tx.Saves — with NO actor-vs-target privilege comparison. The only IsGlobalAdmin guard (user_service.go:345) is a last-admin check inside DeleteUser, not the update path. Role assignment / role CRUD are RequireGlobalAdmin (backend/pkg/authz/permissions.go:27-33), proving users:update is intended below admin.

Impact

Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated users:update permission.

Proof of Concept

1. Admin delegates a custom "User Manager" role with users:update.
2. PUT /users/{adminId} with {"password":"attacker123"}.
3. POST /auth/login {"username":"arcane","password":"attacker123"} → admin session.

Attack Chain

1. Action: admin delegates custom role with users:update. Guard: role creation is RequireGlobalAdmin. Bypass: intended delegation (holder is meant to manage profiles, not seize admin).
2. Action: PUT /users/{adminId} {"password":"attacker123"}. Guard: RequirePermission(users:update) (users.go:154). Bypass: holder has it; no hierarchy check (users.go:317-323, user_service.go:174 unconditional Save).
3. Action: POST /auth/login as admin → admin session.

Bypass Evidence

• users.go:317-323 sets PasswordHash for any target; user_service.go:174-194 has no actor/target privilege comparison.
• Only IsGlobalAdmin hits are DeleteUser's last-admin guard and DTO flags (grep).
• users:update is org-level, held by no built-in non-admin role (permissions.go:24).

Affected Versions

<= 2.5.0.

Reported by zx (Jace) — GitHub: @manus-use

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend