Arcane 2.6.0 Patches Password Reset Flaw Allowing Admin Account Takeover in Prior Versions

The Arcane container management interface has released version 2.6.0 to address a high-severity privilege escalation flaw. The vulnerability, tracked as CVE-2026-96627, allows users with specific delegated permissions to seize full control of the global administrator account.

What happened

Prior to version 2.6.0, the `UpdateUser` function in the Arcane backend failed to verify privilege levels before processing password changes. According to the GitHub advisory for GHSA-pw5q-rjx4-7f7p, the code sets the `PasswordHash` for any target user without comparing the caller's privileges against the target's status. This omission exists in the `backend/api/handlers/users.go` file.

The National Vulnerability Database assigns a CVSS score of 8.8 to this issue. The flaw stems from weaknesses identified as CWE-266 and CWE-269. The `UpdateUser` handler loads a target by ID and applies the new password hash from the request body. It then saves the change via `userService.UpdateUser` without performing an actor-versus-target privilege check.

Role assignment and creation are protected by `RequireGlobalAdmin` guards, as noted in the advisory. However, the `users:update` permission is intended for lower-level profile management, not administrative changes. The missing hierarchy check defeats this separation. A holder of the `users:update` permission can submit a password change for the global administrator. This allows the attacker to replace the administrator password and authenticate as that account.

Why it matters

Complete administrator account takeover is the primary impact of this vulnerability. The advisory describes the impact as high for confidentiality, integrity, and availability. Any user who has been delegated the `users:update` permission can exploit this flaw. The attack chain involves delegating a custom role with the permission, sending a PUT request to reset the admin password, and then logging in as the administrator.

The vendor has confirmed that version 2.6.0 fixes this issue. The source material states that the issue is fixed in version 2.6.0. Systems running versions prior to 2.6.0 remain vulnerable to this attack vector. The flaw does not require additional privileges beyond the delegated `users:update` permission.

What to watch

• Monitor internal logs for unexpected password change events.
• Review which users hold the `users:update` permission.
• Verify that all instances are running version 2.6.0 or later.
• Check for any unauthorized administrative sessions in recent logs.

Who needs to act first

Teams should prioritize updating systems that expose the Arcane interface to internal networks where delegated roles are common. Check whether any non-administrative users have been granted profile management permissions. Roll out the update to test environments first to ensure compatibility with existing container configurations. Back up current configurations before applying the patch. If immediate updating is not possible, restrict access to the management interface to trusted networks only. Reduce the number of users with delegated permissions until the fix is deployed.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Arcane

• Verify the current version of Arcane installed on all servers.
• Update to version 2.6.0 once the vendor provides an update.
• Audit user permissions to remove unnecessary `users:update` grants.
• Monitor authentication logs for suspicious admin login attempts.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this Arcane vulnerability?

The vulnerability is tracked as CVE-2026-96627.

Which versions of Arcane are affected?

All versions prior to 2.6.0 are affected by this flaw.

Is there a fix available for CVE-2026-96627?

Yes, the issue is fixed in version 2.6.0.