Vendor
An authorization flaw in the Arcane user management API allows users with the 'users:update' permission to overwrite administrative credentials and hijack global administrator accounts.