github.com/getarcaneapp/arcane/backend/v2

2 results · Feed

• High 8.8
  CVE-2026-96627

  Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

  Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:updat…

  getarcaneapp arcane github.com/getarcaneapp/arcane/backend github.com/getarcaneapp/arcane/backend/v2 Go
  Oct 16, 2026
• Medium 4.3
  CVE-2026-96628

  Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

  Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated…

  getarcaneapp arcane github.com/getarcaneapp/arcane/backend github.com/getarcaneapp/arcane/backend/v2 Go
  Oct 16, 2026