CVE-2026-96627

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 2.6.0

Description An incorrect privilege assignment exists in the backend where the UpdateUser function in backend/api/handlers/users.go allows the PasswordHash to be set for any target account without verifying if the caller has higher or equal privileges than the target. A user with the users:update permission can change the password of the global administrator, leading to a complete account takeover of the global administrator.

Recommendations Update to version 2.6.0.