github.com/getarcaneapp/arcane/backend/v2

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 8.8

CVE-2026-96627

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:updat…

getarcaneapp arcane github.com/getarcaneapp/arcane/backend github.com/getarcaneapp/arcane/backend/v2 Go

Oct 16, 2026