What’s Vulnerable › Vulnerabilities

CVE-2026-96627: Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-19
• Weakness: CWE-266

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Affected products

• getarcaneapp arcane: before 2.6.0

References

• https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1
• https://github.com/getarcaneapp/arcane/pull/3426
• https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0
• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p
• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p

Get alerted when CVE-2026-96627 or the next vulnerability affects your stack