{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/arcane/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-96627"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Arcane (\u003c= 2.5.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Arcane"],"content_html":"\u003cp\u003eArcane versions 2.5.0 and earlier contain a critical authorization vulnerability within the \u003ccode\u003eUpdateUser\u003c/code\u003e API handler. The application permits users assigned the delegated \u003ccode\u003eusers:update\u003c/code\u003e permission to update the \u003ccode\u003ePasswordHash\u003c/code\u003e of any target user, including global administrators. The vulnerability arises because the backend logic in \u003ccode\u003ebackend/api/handlers/users.go\u003c/code\u003e and \u003ccode\u003euser_service.go\u003c/code\u003e lacks a privilege-hierarchy check, performing an unconditional \u003ccode\u003etx.Save\u003c/code\u003e operation on the user model provided in the request body. While Arcane implements \u003ccode\u003eRequireGlobalAdmin\u003c/code\u003e guards for administrative tasks like role creation, the user management endpoint fails to enforce the separation between standard account profile maintenance and privileged administrative actions. This allows an attacker to reset the administrator's password, authenticate as the admin, and achieve full control over the application environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn administrator creates a custom role for a user, granting them the \u003ccode\u003eusers:update\u003c/code\u003e permission for legitimate profile management tasks.\u003c/li\u003e\n\u003cli\u003eThe attacker, possessing this \u003ccode\u003eusers:update\u003c/code\u003e permission, authenticates to the application using their own account.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the \u003ccode\u003eadminId\u003c/code\u003e for the global administrator account.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a \u003ccode\u003ePUT\u003c/code\u003e request to \u003ccode\u003e/users/{adminId}\u003c/code\u003e with a JSON payload containing a new \u003ccode\u003epassword\u003c/code\u003e field (e.g., \u003ccode\u003e{\u0026quot;password\u0026quot;:\u0026quot;attacker123\u0026quot;}\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server validates the attacker has the \u003ccode\u003eusers:update\u003c/code\u003e permission but fails to verify if the caller is authorized to modify an administrator's account.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eUpdateUser\u003c/code\u003e handler updates the administrator's \u003ccode\u003ePasswordHash\u003c/code\u003e in the database to the attacker's chosen value.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates to the application via \u003ccode\u003ePOST /auth/login\u003c/code\u003e using the compromised administrative credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker obtains an administrative session and takes full control of the platform.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in complete administrative account takeover, enabling unauthorized access to application data, configuration settings, and user management capabilities. This impact is rated with high confidentiality, integrity, and availability loss. Any user with the delegated \u003ccode\u003eusers:update\u003c/code\u003e role can effectively compromise the entire instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the Arcane backend (github.com/getarcaneapp/arcane/backend/v2) to version 2.6.0 or later immediately to patch CVE-2026-96627.\u003c/li\u003e\n\u003cli\u003eConduct an audit of all custom roles and user permissions in the application to ensure that the \u003ccode\u003eusers:update\u003c/code\u003e permission is not granted to untrusted accounts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious \u003ccode\u003ePUT\u003c/code\u003e requests to the \u003ccode\u003e/users/\u003c/code\u003e endpoint directed at known administrator accounts.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, remove the \u003ccode\u003eusers:update\u003c/code\u003e permission from any non-administrative roles to prevent exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T22:28:32Z","date_published":"2026-10-16T22:28:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-arcane-admin-takeover/","summary":"An authorization flaw in the Arcane user management API allows users with the 'users:update' permission to overwrite administrative credentials and hijack global administrator accounts.","title":"Arcane Admin Account Takeover via Improper Authorization","url":"https://feed.craftedsignal.io/briefs/2026-10-arcane-admin-takeover/"}],"language":"en","title":"CraftedSignal Threat Feed - Arcane","version":"https://jsonfeed.org/version/1.1"}