https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 16:27:21 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-96627 <p>Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.</p> <p>Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-96627 https://db.gcve.eu/vuln/ghsa-pw5q-rjx4-7f7p <p><strong>Affected:</strong> Go: github.com/getarcaneapp/arcane/backend/v2</p> <p>## Summary A user holding the delegated `users:update` permission can reset the global administrator&#39;s password and take over the admin account. `UpdateUser` sets the target user&#39;s `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by `RequireGlobalAdmin`, `users:update` is intended to sit BELOW admin (profile management); this finding defeats that separation.</p> <p>## Root Cause `UpdateUser` (handler `backend/api/handlers/users.go:317-323`) loads the target by ID and sets `userModel.PasswordHash` from the request body for any user, then `userService.UpdateUser` (`user_service.go:174`) simply `tx.Save`s — with NO actor-vs-target privilege comparison. The only `IsGlobalAdmin` guard (`user_service.go:345`) is a last-admin check inside `DeleteUser`, not the update path. Role assignment / role CRUD are `RequireGlobalAdmin` (`backend/pkg/authz/permissions.go:27-33`), proving `users:update` is intended below admin.</p> <p>## Impact Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated `users:update` permission.</p> <p>## Proof of Concept 1. Admin delegates a custom &#34;User Manager&#34; role with `users:update`. 2. `PUT /users/{adminId}` with `{&#34;password&#34;:&#34;attacker123&#34;}`. 3. `POST /auth/login {&#34;username&#34;:&#34;arcane&#34;,&#34;password&#34;:&#34;attacker123&#34;}` → admin session.</p> <p>## Attack Chain 1. Action: admin delegates custom role with `users:update`. Guard: role creation is `Require…</p> <p><strong>Affected:</strong> Go: github.com/getarcaneapp/arcane/backend/v2</p> <p>## Summary A user holding the delegated `users:update` permission can reset the global administrator&#39;s password and take over the admin account. `UpdateUser` sets the target user&#39;s `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by `RequireGlobalAdmin`, `users:update` is intended to sit BELOW admin (profile management); this finding defeats that separation.</p> <p>## Root Cause `UpdateUser` (handler `backend/api/handlers/users.go:317-323`) loads the target by ID and sets `userModel.PasswordHash` from the request body for any user, then `userService.UpdateUser` (`user_service.go:174`) simply `tx.Save`s — with NO actor-vs-target privilege comparison. The only `IsGlobalAdmin` guard (`user_service.go:345`) is a last-admin check inside `DeleteUser`, not the update path. Role assignment / role CRUD are `RequireGlobalAdmin` (`backend/pkg/authz/permissions.go:27-33`), proving `users:update` is intended below admin.</p> <p>## Impact Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated `users:update` permission.</p> <p>## Proof of Concept 1. Admin delegates a custom &#34;User Manager&#34; role with `users:update`. 2. `PUT /users/{adminId}` with `{&#34;password&#34;:&#34;attacker123&#34;}`. 3. `POST /auth/login {&#34;username&#34;:&#34;arcane&#34;,&#34;password&#34;:&#34;attacker123&#34;}` → admin session.</p> <p>## Attack Chain 1. Action: admin delegates custom role with `users:update`. Guard: role creation is `Require…</p> https://db.gcve.eu/vuln/ghsa-pw5q-rjx4-7f7p