CVE-2026-96627: Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Vulnerability summary
CVE-2026-96627 is a high (CVSS 8.8) Incorrect Privilege Assignment vulnerability in getarcaneapp arcane. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.6% of scored vulnerabilities.
Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 16-10-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Getarcaneapp1 product
- arcane< 2.6.0
Github.com/getarcaneapp/arcane1 product
- backendAll versions (No fix recorded)
Github.com/getarcaneapp/arcane/backend1 product
- v2< 2.6.0
3 vendors · 3 products
References
5 links- github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7pX Refsource CONFIRMWEBAdvisory