CVE-2026-96627

8.8 Élevée

Publiée le 17/10/2026 à 00:18 · Modifiée le 19/10/2026 à 17:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

Traduire en français

Produits concernés

getarcaneapp arcane

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-266
CWE-269

Références

https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1
https://github.com/getarcaneapp/arcane/pull/3426
https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0
https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p
https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories