Arcane Admin Account Takeover via Improper Authorization

Arcane versions 2.5.0 and earlier contain a critical authorization vulnerability within the UpdateUser API handler. The application permits users assigned the delegated users:update permission to update the PasswordHash of any target user, including global administrators. The vulnerability arises because the backend logic in backend/api/handlers/users.go and user_service.go lacks a privilege-hierarchy check, performing an unconditional tx.Save operation on the user model provided in the request body. While Arcane implements RequireGlobalAdmin guards for administrative tasks like role creation, the user management endpoint fails to enforce the separation between standard account profile maintenance and privileged administrative actions. This allows an attacker to reset the administrator's password, authenticate as the admin, and achieve full control over the application environment.

Attack Chain

1. An administrator creates a custom role for a user, granting them the users:update permission for legitimate profile management tasks.
2. The attacker, possessing this users:update permission, authenticates to the application using their own account.
3. The attacker identifies the adminId for the global administrator account.
4. The attacker sends a PUT request to /users/{adminId} with a JSON payload containing a new password field (e.g., {"password":"attacker123"}).
5. The server validates the attacker has the users:update permission but fails to verify if the caller is authorized to modify an administrator's account.
6. The UpdateUser handler updates the administrator's PasswordHash in the database to the attacker's chosen value.
7. The attacker authenticates to the application via POST /auth/login using the compromised administrative credentials.
8. The attacker obtains an administrative session and takes full control of the platform.

Impact

The vulnerability results in complete administrative account takeover, enabling unauthorized access to application data, configuration settings, and user management capabilities. This impact is rated with high confidentiality, integrity, and availability loss. Any user with the delegated users:update role can effectively compromise the entire instance.

Recommendation

1. Upgrade the Arcane backend (github.com/getarcaneapp/arcane/backend/v2) to version 2.6.0 or later immediately to patch CVE-2026-96627.
2. Conduct an audit of all custom roles and user permissions in the application to ensure that the users:update permission is not granted to untrusted accounts.
3. Monitor web server logs for suspicious PUT requests to the /users/ endpoint directed at known administrator accounts.
4. If patching is not immediately feasible, remove the users:update permission from any non-administrative roles to prevent exploitation.