Arcane 2.6.0 Fixes Flaw Allowing Delegated Users to Hijack Admin Accounts
A missing privilege check in older Arcane versions lets holders of a specific delegation permission reset the global administrator password and seize full control.
Key points
- CVE-2026-96627 affects Arcane versions prior to 2.6.0.
- The flaw carries a CVSS score of 8.8, rated as high severity.
- Attackers need only the delegated users:update permission to exploit it.
Holders of a specific delegated permission in older versions of Arcane can seize complete control of the global administrator account by resetting its password. The vulnerability, identified as CVE-2026-96627, exists in the interface used for managing Docker containers, images, networks, and volumes. It allows a user with limited rights to elevate their status to full administrator, bypassing intended security boundaries.
In plain English
The Arcane system allows administrators to delegate certain tasks to other users. One such task is the ability to update user profiles, governed by the users:update permission. In versions before 2.6.0, the software does not verify whether the person changing a password has the right to change the administrator's password. This means anyone with that specific permission can overwrite the admin's credentials.
The background
The National Vulnerability Database rates CVE-2026-96627 as high severity with a CVSS score of 8.8. The weakness stems from how the UpdateUser function handles requests in the backend API. According to the GitHub advisory GHSA-pw5q-rjx4-7f7p, the code sets the password hash for any target user without comparing the caller's privilege level against the target's. This defeats the separation between profile management and administrative controls.
What changes now
The vendor released version 2.6.0 to address this issue. This update fixes the flaw that allowed unauthorized password resets for the global administrator. Users running versions earlier than 2.6.0 are vulnerable and should upgrade to prevent potential account takeover. The patch resolves the missing privilege comparison in the user update handler.
What made it possible
Security teams usually rely on strict privilege separation to ensure that delegated permissions cannot override administrative controls. When a system allows a low-privilege action to modify high-privilege targets without validation, it creates a critical elevation path. Check whether your identity management systems enforce hierarchical checks during credential updates. Ensure that role-based access controls verify the actor's authority relative to the target resource, rather than just checking for the presence of a generic update permission.
What to do and how to stay safe: Arcane
- Upgrade Arcane to version 2.6.0 or later to apply the vendor-provided fix.
- Audit current user permissions to identify any accounts holding the users:update delegation.
- Monitor authentication logs for unexpected password changes to administrative accounts.
- Review role definitions to ensure delegated permissions do not overlap with administrative functions.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96627?
The vulnerability has a CVSS score of 8.8, which is rated as high severity.
Which versions of Arcane are affected by this flaw?
All versions of Arcane prior to 2.6.0 are vulnerable to this privilege escalation issue.
What permission is needed to exploit this vulnerability?
An attacker needs the delegated users:update permission to reset the global administrator's password.
