CVE-2026-96627High· 8.8▾ TwilightArcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation.
UpdateUser (handler backend/api/handlers/users.go:317-323) loads the target by ID and sets userModel.PasswordHash from the request body for any user, then userService.UpdateUser (user_service.go:174) simply tx.Saves — with NO actor-vs-target privilege comparison. The only IsGlobalAdmin guard (user_service.go:345) is a last-admin check inside DeleteUser, not the update path. Role assignment / role CRUD are RequireGlobalAdmin (backend/pkg/authz/permissions.go:27-33), proving users:update is intended below admin.
Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated users:update permission.
users:update.PUT /users/{adminId} with {"password":"attacker123"}.POST /auth/login {"username":"arcane","password":"attacker123"} → admin session.users:update. Guard: role creation is RequireGlobalAdmin. Bypass: intended delegation (holder is meant to manage profiles, not seize admin).PUT /users/{adminId} {"password":"attacker123"}. Guard: RequirePermission(users:update) (users.go:154). Bypass: holder has it; no hierarchy check (users.go:317-323, user_service.go:174 unconditional Save).POST /auth/login as admin → admin session.users.go:317-323 sets PasswordHash for any target; user_service.go:174-194 has no actor/target privilege comparison.IsGlobalAdmin hits are DeleteUser's last-admin guard and DTO flags (grep).users:update is org-level, held by no built-in non-admin role (permissions.go:24).<= 2.5.0.
Reported by zx (Jace) — GitHub: @manus-use
github.com/getarcaneapp/arcane/backend/v2 < 2.6.0Upgrade to a patched release:
github.com/getarcaneapp/arcane/backend/v2 2.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96628Medium· 4.3Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
CVE-2026-40242High· 7.2Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
CVE-2026-47179High· 7.7Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
CVE-2026-86114Medium· 6.5Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults
CVE-2026-116471Medium· 4.3BKWLD Decoy Authorization Policy Policy.php privileges management
CVE-2026-116223Medium· 6.5icret EasyImage del.php privileges management