CVE-2026-96627: Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
A user holding the delegated users:update permission can reset the global administrator’s password and take over the admin account. UpdateUser sets the target user’s PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation.
References
- github.com/advisories/GHSA-pw5q-rjx4-7f7p
- github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1
- github.com/getarcaneapp/arcane/pull/3426
- github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0
- github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p
- nvd.nist.gov/vuln/detail/CVE-2026-96627
Code Behaviors & Features
Detect and mitigate CVE-2026-96627 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →