{"id":"CVE-2026-96627","aliases":["EUVD-2026-103178","GHSA-pw5q-rjx4-7f7p","GO-2026-6807"],"status":"published","title":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00368,"percentile":0.31068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-266","CWE-269"],"published":"2026-10-16T21:13:16Z","modified":"2026-10-28T02:31:15Z","fixes":[{"ecosystem":"Go","package":"github.com/getarcaneapp/arcane/backend/v2","fixed_in":["2.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/getarcaneapp/arcane/backend/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/getarcaneapp/arcane/backend/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/getarcaneapp/arcane/backend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/getarcaneapp/arcane/backend/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]}],"products":[{"vendor":"getarcaneapp","product":"arcane"}],"references":[{"url":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/getarcaneapp/arcane/pull/3426","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-pw5q-rjx4-7f7p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96627.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96627","tags":["advisory"]},{"url":"https://github.com/getarcaneapp/arcane","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-96627","title":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.","status":"published","published":"2026-10-16T21:13:16.717Z","modified":"2026-10-19T14:34:05.584Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-266","CWE-269"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-103178","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.","status":"published","published":"2026-10-16T21:13:16Z","modified":"2026-10-19T14:34:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:51.186399Z"}],"ghsa":[{"id":"GHSA-pw5q-rjx4-7f7p","title":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)","description":"## Summary\nA user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by `RequireGlobalAdmin`, `users:update` is intended to sit BELOW admin (profile management); this finding defeats that separation.\n\n## Root Cause\n`UpdateUser` (handler `backend/api/handlers/users.go:317-323`) loads the target by ID and sets `userModel.PasswordHash` from the request body for any user, then `userService.UpdateUser` (`user_service.go:174`) simply `tx.Save`s — with NO actor-vs-target privilege comparison. The only `IsGlobalAdmin` guard (`user_service.go:345`) is a last-admin check inside `DeleteUser`, not the update path. Role assignment / role CRUD are `RequireGlobalAdmin` (`backend/pkg/authz/permissions.go:27-33`), proving `users:update` is intended below admin.\n\n## Impact\nComplete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated `users:update` permission.\n\n## Proof of Concept\n1. Admin delegates a custom \"User Manager\" role with `users:update`.\n2. `PUT /users/{adminId}` with `{\"password\":\"attacker123\"}`.\n3. `POST /auth/login {\"username\":\"arcane\",\"password\":\"attacker123\"}` → admin session.\n\n## Attack Chain\n1. Action: admin delegates custom role with `users:update`. Guard: role creation is `RequireGlobalAdmin`. Bypass: intended delegation (holder is meant to manage profiles, not seize admin).\n2. Action: `PUT /users/{adminId}` `{\"password\":\"attacker123\"}`. Guard: `RequirePermission(users:update)` (`users.go:154`). Bypass: holder has it; no hierarchy check (`users.go:317-323`, `user_service.go:174` unconditional Save).\n3. Action: `POST /auth/login` as admin → admin session.\n\n## Bypass Evidence\n- `users.go:317-323` sets `PasswordHash` for any target; `user_service.go:174-194` has no actor/target privilege comparison.\n- Only `IsGlobalAdmin` hits are `DeleteUser`'s last-admin guard and DTO flags (grep).\n- `users:update` is org-level, held by no built-in non-admin role (`permissions.go:24`).\n\n## Affected Versions\n`\u003c= 2.5.0`.\n\nReported by **zx (Jace)** — GitHub: @manus-use","status":"published","published":"2026-10-16T21:15:03Z","modified":"2026-10-16T21:15:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-266","CWE-269"],"updated_at":"2026-11-02T14:41:32.483482Z"}],"nvd":[{"id":"CVE-2026-96627","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.","status":"published","published":"2026-10-16T22:18:58.227Z","modified":"2026-10-19T15:17:09.873Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-266","CWE-269"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-96627","title":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.","status":"published","published":"2026-10-16T21:13:16.717Z","modified":"2026-10-28T02:31:15.014043333Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-266","CWE-269"],"updated_at":"2026-11-02T15:45:21.262447Z"},{"id":"GHSA-pw5q-rjx4-7f7p","title":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)","description":"## Summary\nA user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by `RequireGlobalAdmin`, `users:update` is intended to sit BELOW admin (profile management); this finding defeats that separation.\n\n## Root Cause\n`UpdateUser` (handler `backend/api/handlers/users.go:317-323`) loads the target by ID and sets `userModel.PasswordHash` from the request body for any user, then `userService.UpdateUser` (`user_service.go:174`) simply `tx.Save`s — with NO actor-vs-target privilege comparison. The only `IsGlobalAdmin` guard (`user_service.go:345`) is a last-admin check inside `DeleteUser`, not the update path. Role assignment / role CRUD are `RequireGlobalAdmin` (`backend/pkg/authz/permissions.go:27-33`), proving `users:update` is intended below admin.\n\n## Impact\nComplete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated `users:update` permission.\n\n## Proof of Concept\n1. Admin delegates a custom \"User Manager\" role with `users:update`.\n2. `PUT /users/{adminId}` with `{\"password\":\"attacker123\"}`.\n3. `POST /auth/login {\"username\":\"arcane\",\"password\":\"attacker123\"}` → admin session.\n\n## Attack Chain\n1. Action: admin delegates custom role with `users:update`. Guard: role creation is `RequireGlobalAdmin`. Bypass: intended delegation (holder is meant to manage profiles, not seize admin).\n2. Action: `PUT /users/{adminId}` `{\"password\":\"attacker123\"}`. Guard: `RequirePermission(users:update)` (`users.go:154`). Bypass: holder has it; no hierarchy check (`users.go:317-323`, `user_service.go:174` unconditional Save).\n3. Action: `POST /auth/login` as admin → admin session.\n\n## Bypass Evidence\n- `users.go:317-323` sets `PasswordHash` for any target; `user_service.go:174-194` has no actor/target privilege comparison.\n- Only `IsGlobalAdmin` hits are `DeleteUser`'s last-admin guard and DTO flags (grep).\n- `users:update` is org-level, held by no built-in non-admin role (`permissions.go:24`).\n\n## Affected Versions\n`\u003c= 2.5.0`.\n\nReported by **zx (Jace)** — GitHub: @manus-use","status":"published","published":"2026-10-16T21:15:03Z","modified":"2026-10-19T21:40:44.932520248Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-266","CWE-269"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"GO-2026-6807","title":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend","description":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend","status":"published","published":"2026-10-19T21:08:35Z","modified":"2026-10-19T21:31:38.407415618Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}