Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.6.0 → 2.6.0
A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation. Root Cause UpdateUser (handler backen…
Read on GitHub Advisory Database
| CVE | CVE-2026-96627 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 01:17 AM |
| Data | Markdown JSON |
On 10/17/2026, 06:15 AM, GitHub Advisory Database published "Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)" (type: Advisory). Severity is "High" (high). Related technologies: Go, GitHub. CVE: CVE-2026-96627.