ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-96627

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · Arcane: Delegated users:update permission

Check if you run it

No confirmed exploitation is on record for CVE-2026-96627. EPSS is 0.29%. Act only if a listed version of Arcane: Delegated users:update permission is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Arcane: Delegated users:update permission).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.29%
Remediation
Version ranges on file
Affected products
Go github.com/getarcaneapp/arcane/backend/v2 · go github.com/getarcaneapp/arcane/backend/v2 · golang github.com

## Summary A user holding the delegated permission can reset the global administrator's password and take over the admin account. sets the target user's from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by , is intended to sit BELOW admin (profile management); this finding defeats that separation. ## Root Cause (handler ) loads the target by ID and sets from the request body for any user, then ( ) simply s — with NO actor-vs-target privilege comparison. The only guard ( ) is a last-admin check inside , not the update path. Role assignment / role CRUD are ( ), proving is intended below admin. ## Impact Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated permission. ## Proof of Concept 1. Admin delegates a custom "User Manager" role with . 2. with . 3. → admin session. ## Attack Chain 1. Action: admin delegates custom role with . Guard: role creation is . Bypass: intended delegation (holder is meant to manage profiles, not seize admin). 2. Action: . Guard: ( ). Bypass: holder has it; no hierarchy check ( , unconditional Save). 3. Action: as admin → admin session. ## Bypass Evidence - sets for any target; has no actor/target privilege comparison. - Only hits are 's last-admin guard and DTO flags (grep). - is org-level, held by no built-in non-admin role ( ). ## Affected Versions . Reported by **zx (Jace)** — GitHub: @manus-use

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/getarcaneapp/arcane/backend/v20 → 2.6.0
  • go github.com/getarcaneapp/arcane/backend/v2< 2.6.0
  • go github.com/getarcaneapp/arcane/backend/v2<2.6.0
  • golang github.comversion unspecified

How to fix CVE-2026-96627

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-96627. EPSS is 0.29%. Act only if a listed version of Arcane: Delegated users:update permission is installed.

Which versions are affected?

Compare what you have installed with 0 → 2.6.0, < 2.6.0, <2.6.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-266; CWE-269: Improper Privilege Management. EPSS 0.29%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ## Summary A user holding the delegated permission can reset the global administrator's password and take over the admin account. sets the target user's from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by , is intended to sit BELOW admin (profile management); this finding defeats that separation. ##

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/getarcaneapp/arcane/backend/v2 fixed in 2.6.0

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/getarcaneapp/arcane/backend/v2 fixed in 2.6.0

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ## Summary A user holding the delegated permission can reset the global administrator's password and take over the admin account. sets the target user's from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by , is intended to sit BELOW admin (profile management); this finding defeats that separation. ##

Sources

  • CVE.orgVulnerability recordCVE-2026-96627

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-96627

    30-day exploitation probability 0.3%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-pw5q-rjx4-7f7p

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-96627

    A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profi

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorygo/github.com/getarcaneapp/arcane/backend/v2/CVE-2026-96627.yml

    A user holding the delegated permission can reset the + global administrator's password and take over the admin account. sets + the target user's from the request body for ANY target with no comparison + of caller-vs-target privilege. Because role assignment and role CRUD are deliberately + gated by , is intended to sit BELOW admin (profile + management); this finding defeats that separation." +da

    gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-pw5q-rjx4-7f7p

    Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-pw5q-rjx4-7f7p

    Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.