CVE-2026-96627
highArcane is an interface for managing Docker containers, images, networks, and volumes.
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1 security-advisories@github.com
- https://github.com/getarcaneapp/arcane/pull/3426 security-advisories@github.com
- https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0 security-advisories@github.com
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p security-advisories@github.com
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p 134c704f-9b21-4f2e-91b3-4a467353bcc0