## Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- CVE: CVE-2026-96627
- 公開日時: 2026-10-16T21:15:03.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-pw5q-rjx4-7f7p)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-pw5q-rjx4-7f7p

影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.6.0 → 2.6.0
Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation. Root Cause UpdateUser (handler backen…