Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.6.0 → 2.6.0

A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation. Root Cause UpdateUser (handler backen…

GitHub Advisory Databaseで読む

2026/10/17 06:15、GitHub Advisory Databaseが「Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Go、GitHub。CVE: CVE-2026-96627。