CVE-2026-96627

01/תיאור (מקור, אנגלית)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

02/קישורים5

• github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a0‮…
• github.com/getarcaneapp/arcane/pull/3426
• github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0
• github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-r‮…
• github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-r‮…