CVE-2026-96627

Deferred Deferred - Pending Action

Password Change Privilege Escalation in Arcane

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-96627

Affected Vendors & Products

Vendor	Product	Version / Range
getarcaneapp	arcane	< 2.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in Arcane, a Docker management interface. Before version 2.6.0, a user with delegated permission to update other users could change the password of the global administrator account without proper privilege checks. This allows an attacker to take over the administrator account, gaining full control over the system.

Detection Guidance

This vulnerability can be detected by checking the Arcane software version. If your system is running Arcane prior to version 2.6.0, it is vulnerable. Use the command 'arcane version' or check the installed package version to verify.

Impact Analysis

If you use Arcane versions before 2.6.0, an attacker with delegated user update permissions could escalate privileges and take over the global administrator account. This could lead to unauthorized access, data breaches, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade Arcane to version 2.6.0 or later to address the privilege escalation flaw. Review user permissions to ensure delegated users:update permissions are not granted to untrusted accounts. Monitor for unauthorized password changes or administrator account access.

Hi! I’m here to help you understand CVE-2026-96627. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70