Arcane: Privilege escalation to administrator account takeover via users:update
Summary
Arcane, a web interface for managing Docker containers, images, networks and volumes, does not check the privileges of the caller when updating users. A user with the delegated users:update permission can change the password of the global administrator and then log in as that administrator. This leads to full takeover of the administrator account.
Affected
- Arcane versions before 2.6.0
- Lower bound of the affected range: Unknown.
Fixed in
- Arcane 2.6.0
Workaround
- No vendor workaround known. Upgrading to 2.6.0 or later is the remedy.
Exploitation
- No known exploitation in the wild according to available sources.
- Public proof-of-concept: Unknown.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Upgrade Arcane to version 2.6.0 or later.
- Review which accounts hold the users:update permission and remove it where not required.
- Check the administrator account for unexpected password changes and review recent user activity.
- Restrict network access to the Arcane web interface, especially if it is reachable from untrusted networks.
- Monitor for logins to administrator accounts from unusual sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pw5q-rjx4-7f7p github.com
- Fix commit 21ea962 github.com
- Pull Request #3426 github.com
- Arcane release backend/v2.6.0 github.com
- OSV GHSA-pw5q-rjx4-7f7p osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:55.
Original description (NVD)
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
NVD references (5)
- https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1
- https://github.com/getarcaneapp/arcane/pull/3426
- https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.