---
id: CVE-2026-96627
aliases:
  - GHSA-pw5q-rjx4-7f7p
title: >-
  Arcane: Delegated users:update permission allows admin account takeover via
  password reset (no privilege-hierarchy check)
summary: >-
  Arcane: Delegated users:update permission allows admin account takeover via
  password reset (no privilege-hierarchy check)
severity: high
cvss: 8.8
cwe:
  - CWE-266
  - CWE-269
vendor: getarcaneapp
product: github.com/getarcaneapp/arcane/backend/v2
ecosystem: go
affected:
  - github.com/getarcaneapp/arcane/backend/v2 < 2.6.0
patched:
  - github.com/getarcaneapp/arcane/backend/v2 2.6.0
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T21:15:06Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-pw5q-rjx4-7f7p'
references:
  - url: >-
      https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p
  - url: 'https://github.com/getarcaneapp/arcane/pull/3426'
  - url: >-
      https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1
  - url: 'https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0'
  - url: 'https://github.com/advisories/GHSA-pw5q-rjx4-7f7p'
tags:
  - ghsa
  - go
  - cve.org
ingestedAt: '2026-10-16T21:53:23.549Z'
---

## Overview

## Summary
A user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by `RequireGlobalAdmin`, `users:update` is intended to sit BELOW admin (profile management); this finding defeats that separation.

## Root Cause
`UpdateUser` (handler `backend/api/handlers/users.go:317-323`) loads the target by ID and sets `userModel.PasswordHash` from the request body for any user, then `userService.UpdateUser` (`user_service.go:174`) simply `tx.Save`s — with NO actor-vs-target privilege comparison. The only `IsGlobalAdmin` guard (`user_service.go:345`) is a last-admin check inside `DeleteUser`, not the update path. Role assignment / role CRUD are `RequireGlobalAdmin` (`backend/pkg/authz/permissions.go:27-33`), proving `users:update` is intended below admin.

## Impact
Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated `users:update` permission.

## Proof of Concept
1. Admin delegates a custom "User Manager" role with `users:update`.
2. `PUT /users/{adminId}` with `{"password":"attacker123"}`.
3. `POST /auth/login {"username":"arcane","password":"attacker123"}` → admin session.

## Attack Chain
1. Action: admin delegates custom role with `users:update`. Guard: role creation is `RequireGlobalAdmin`. Bypass: intended delegation (holder is meant to manage profiles, not seize admin).
2. Action: `PUT /users/{adminId}` `{"password":"attacker123"}`. Guard: `RequirePermission(users:update)` (`users.go:154`). Bypass: holder has it; no hierarchy check (`users.go:317-323`, `user_service.go:174` unconditional Save).
3. Action: `POST /auth/login` as admin → admin session.

## Bypass Evidence
- `users.go:317-323` sets `PasswordHash` for any target; `user_service.go:174-194` has no actor/target privilege comparison.
- Only `IsGlobalAdmin` hits are `DeleteUser`'s last-admin guard and DTO flags (grep).
- `users:update` is org-level, held by no built-in non-admin role (`permissions.go:24`).

## Affected Versions
`<= 2.5.0`.

Reported by **zx (Jace)** — GitHub: @manus-use

## Affected packages

- `github.com/getarcaneapp/arcane/backend/v2 < 2.6.0`

## Remediation

Upgrade to a patched release:

- `github.com/getarcaneapp/arcane/backend/v2 2.6.0`