CVE-2026-96627 · GHSA-pw5q-rjx4-7f7p

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Risk score: 67/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.3%
Published: 16 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global adm…
Affected: github.com/getarcaneapp/arcane/backend/v2 (go) < 2.6.0
Fix: Upgrade github.com/getarcaneapp/arcane/backend/v2 to 2.6.0 or later.
Exploitation: Public proof of concept

Why it is Amber

CVSS 8.8 high
Public exploit or proof of concept referenced
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/getarcaneapp/arcane/backend/v2	go	< 2.6.0	2.6.0

References

Original description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Last activity 16 Oct 2026. Patch Forecast updates every hour.