Orgs at risk: Arcane 2.6.0 blocks privileged users from resetting admin passwords via missing check

A missing security check in the Arcane container management interface allowed users with limited permissions to reset administrator passwords and seize full control of the system. This flaw, tracked as CVE-2026-96627, enabled complete account takeover by any holder of a specific delegated permission, compromising the integrity of the platform's access controls.

The vulnerability was addressed in version 2.6.0, which corrects the underlying logic error. Prior to this release, the application failed to verify whether the user initiating a password change had sufficient authority to modify the target account, particularly when that target was the global administrator.

What we know

According to the National Vulnerability Database, the flaw carries a CVSS score of 8.8, rated as high severity. The issue stems from weaknesses classified as CWE-266 and CWE-269, involving incorrect default permissions and improper privilege management. The affected component is the `UpdateUser` function within the backend API handlers, specifically in the file `users.go`.

GitHub advisory GHSA-pw5q-rjx4-7f7p details that the `UpdateUser` handler sets the password hash for any target user without comparing the caller's privileges against the target's. This occurs despite role assignment and creation being strictly gated by global administrator requirements. The `users:update` permission is intended for profile management below the admin level, but the flaw defeats this separation of duties.

Any user holding the delegated `users:update` permission could submit a password change request for the global administrator. By sending a specific HTTP request to the API endpoint, an attacker could replace the administrator's password hash with one of their choosing. This allowed them to authenticate as the global administrator, resulting in complete account takeover.

The root cause is located in lines 317-323 of `users.go`, where the target user is loaded and the password hash is set unconditionally. The subsequent service update in `user_service.go` saves these changes without performing an actor-versus-target privilege comparison. The only existing guard for global admin status was a check within the user deletion function, not the update path.

Defender's checklist

• Review current Arcane installations to confirm they are running version 2.6.0 or later.
• Audit user roles to identify any accounts holding the `users:update` delegated permission.
• Monitor authentication logs for unexpected password changes, especially those affecting administrative accounts.
• Verify that role creation and modification remain restricted to global administrators only.

The background in plain language

Privilege escalation occurs when a user gains higher-level access than intended. In secure systems, permissions are layered, with lower-level roles unable to modify higher-level accounts. This incident highlights the importance of verifying authority at every action point. Teams usually implement strict checks to ensure a user cannot alter accounts above their own level. Checking whether role boundaries are enforced prevents accidental or malicious overrides.

Background: Privilege escalation vulnerabilities

Detect privilege escalation by correlating authentication logs with file permission changes and process creation events. Look for unusual parent-child process relationships, unexpected service account usage and deviations from baseline behaviour. Use endpoint detection platforms to catch runtime anomalies that static scans miss.

Read the full guide: Detect Privilege Escalation: Signals, Tools and Blind Spots

What to do and how to stay safe: Arcane

• Update all instances of Arcane to version 2.6.0 to apply the vendor's fix.
• Rotate passwords for all administrative accounts immediately, even if no compromise is suspected.
• Review audit logs for any unauthorized password changes or login attempts from unexpected sources.
• Restrict the `users:update` permission to only those who strictly require profile management duties.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96627?

The National Vulnerability Database rates the severity as 8.8, which is classified as high.

Which versions of Arcane are affected by this flaw?

All versions of Arcane prior to 2.6.0 are vulnerable to this privilege escalation issue.

How was the flaw exploited to take over the admin account?

A user with `users:update` permission sent a request to change the admin's password, bypassing privilege checks.