CVE-2026-96627CWE-266CWE-269privilege-escalation

CVE-2026-96627

High · published October 17, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.4th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-269 · Improper Privilege Management
Published
2026-10-17T02:18Z
References (5)
https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1 · [email protected]https://github.com/getarcaneapp/arcane/pull/3426 · [email protected]https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0 · [email protected]https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p · [email protected]https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 16 OCT 21:13Z
    Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
    cvelistv5
  • 16 OCT 21:13Z
    Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
    cvelistv5