Summary
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation.
Root Cause
UpdateUser (handler backend/api/handlers/users.go:317-323) loads the target by ID and sets userModel.PasswordHash from the request body for any user, then userService.UpdateUser (user_service.go:174) simply tx.Saves, with NO actor-vs-target privilege comparison. The only IsGlobalAdmin guard (user_service.go:345) is a last-admin check inside DeleteUser, not the update path. Role assignment / role CRUD are RequireGlobalAdmin (backend/pkg/authz/permissions.go:27-33), proving users:update is intended below admin.
Proof of Concept
- Admin delegates a custom "User Manager" role with
users:update. PUT /users/{adminId}with{"password":"attacker123"}.POST /auth/login {"username":"arcane","password":"attacker123"}→ admin session.
Attack Chain
- Action: admin delegates custom role with
users:update. Guard: role creation isRequireGlobalAdmin. Bypass: intended delegation (holder is meant to manage profiles, not seize admin). - Action:
PUT /users/{adminId}{"password":"attacker123"}. Guard:RequirePermission(users:update)(users.go:154). Bypass: holder has it; no hierarchy check (users.go:317-323,user_service.go:174unconditional Save). - Action:
POST /auth/loginas admin → admin session.
Bypass Evidence
users.go:317-323setsPasswordHashfor any target;user_service.go:174-194has no actor/target privilege comparison.- Only
IsGlobalAdminhits areDeleteUser's last-admin guard and DTO flags (grep). users:updateis org-level, held by no built-in non-admin role (permissions.go:24).
Affected Versions
<= 2.5.0.
Reported by zx (Jace), GitHub: @manus-use
Impact
Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated users:update permission.
The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access. Typical impact: privilege escalation beyond the intended level.
CVE-2026-96627 has a CVSS score of 8.8 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.6.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-96627? CVE-2026-96627 is a high-severity improper privilege management vulnerability in github.com/getarcaneapp/arcane/backend/v2 (go), affecting versions < 2.6.0. It is fixed in 2.6.0. The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access.
- How severe is CVE-2026-96627? CVE-2026-96627 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/getarcaneapp/arcane/backend/v2 are affected by CVE-2026-96627? github.com/getarcaneapp/arcane/backend/v2 (go) versions < 2.6.0 is affected.
- Is there a fix for CVE-2026-96627? Yes. CVE-2026-96627 is fixed in 2.6.0. Upgrade to this version or later.
- Is CVE-2026-96627 exploitable, and should I be worried? Whether CVE-2026-96627 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-96627 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-96627? Upgrade
github.com/getarcaneapp/arcane/backend/v2to 2.6.0 or later.