CVE-2026-96627
8.8HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-266, CWE-269
Impact
An authenticated user with delegated users:update privileges can take over the global administrator account by overwriting their password. This allows full administrative compromise of the Arcane Docker management interface.
Root cause
The UpdateUser handler fails to compare caller and target privilege levels before setting a new PasswordHash.
Affected systems
Arcane versions prior to 2.6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Arcane to version 2.6.0 or later. If patching immediately is not possible, revoke the users:update permission from all non-administrative users.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.