CVE-2026-96627

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-96627
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96627.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-96627
Aliases
Published
2026-10-16T21:13:16Z
Modified
2026-10-21T03:00:21Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Details

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-266",
        "CWE-269"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96627.json"
}
References

Affected packages

Git / github.com/getarcaneapp/arcane

Affected ranges

Type
GIT
Repo
https://github.com/getarcaneapp/arcane
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b894618b0c310fce64823cec240516ef42880747
Fixed
21ea962f86d967dac8ae02a050f6e5f043d10fa1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.6.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "21ea962f86d967dac8ae02a050f6e5f043d10fa1"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

backend/v1.*
backend/v1.15.3
backend/v1.16.0
backend/v1.16.1
backend/v1.16.2
backend/v1.16.3
backend/v1.17.0
backend/v1.17.1
backend/v1.17.2
backend/v1.17.3
backend/v1.17.4
backend/v1.18.0
backend/v1.18.1
backend/v1.19.0
backend/v1.19.1
backend/v1.19.2
backend/v1.19.3
backend/v1.19.4
backend/v1.19.5
backend/v1.20.0
backend/v2.*
backend/v2.0.0
backend/v2.0.1
backend/v2.0.2
backend/v2.0.3
backend/v2.1.0
backend/v2.2.0
backend/v2.3.0
backend/v2.3.1
backend/v2.3.2
backend/v2.4.0
backend/v2.5.0
cli/v1.*
cli/v1.15.0
cli/v1.15.1
cli/v1.15.2
cli/v1.15.3
cli/v1.16.0
cli/v1.16.1
cli/v1.16.2
cli/v1.16.3
cli/v1.17.0
cli/v1.17.1
cli/v1.17.2
cli/v1.17.3
cli/v1.17.4
cli/v1.18.0
cli/v1.18.1
cli/v1.19.0
cli/v1.19.1
cli/v1.19.2
cli/v1.19.3
cli/v1.19.4
cli/v1.19.5
cli/v1.20.0
cli/v2.*
cli/v2.0.0
cli/v2.0.1
cli/v2.0.2
cli/v2.0.3
cli/v2.1.0
cli/v2.2.0
cli/v2.3.0
cli/v2.3.1
cli/v2.3.2
cli/v2.4.0
cli/v2.5.0
types/v1.*
types/v1.15.0
types/v1.15.1
types/v1.15.2
types/v1.15.3
types/v1.16.0
types/v1.16.1
types/v1.16.2
types/v1.16.3
types/v1.17.0
types/v1.17.1
types/v1.17.2
types/v1.17.3
types/v1.17.4
types/v1.18.0
types/v1.18.1
types/v1.19.0
types/v1.19.1
types/v1.19.2
types/v1.19.3
types/v1.19.4
types/v1.19.5
types/v1.20.0
types/v2.*
types/v2.0.0
types/v2.0.1
types/v2.0.2
types/v2.0.3
types/v2.1.0
types/v2.2.0
types/v2.3.0
types/v2.3.1
types/v2.3.2
types/v2.4.0
types/v2.5.0
v0.*
v0.1.0
v0.1.1
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.15.1
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.10.0
v1.10.1
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.13.0
v1.13.1
v1.13.2
v1.14.0
v1.14.1
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.16.0
v1.16.1
v1.16.2
v1.16.3
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.18.0
v1.18.1
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.2.0
v1.2.1
v1.2.2
v1.20.0
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.9.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.2.0
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96627.json"