Privilege escalation in Getarcaneapp Arcane
CVE-2026-96627
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Getarcaneapp Arcane — versions < 2.6.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-96627?
- CVE-2026-96627 is a high-severity vulnerability in Getarcaneapp Arcane, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2026-10-16.
- How severe is CVE-2026-96627?
- High severity. CVSS v3 base score is 8.8 out of 10.