{"schema":"threatline.record/2","record":{"id":"CVE-2026-96627","aliases":["GHSA-pw5q-rjx4-7f7p","GO-2026-6807"],"summary":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)","details":"## Summary\nA user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by `RequireGlobalAdmin`, `users:update` is intended to sit BELOW admin (profile management); this finding defeats that separation.\n\n## Root Cause\n`UpdateUser` (handler `backend/api/handlers/users.go:317-323`) loads the target by ID and sets `userModel.PasswordHash` from the request body for any user, then `userService.UpdateUser` (`user_service.go:174`) simply `tx.Save`s — with NO actor-vs-target privilege comparison. The only `IsGlobalAdmin` guard (`user_service.go:345`) is a last-admin check inside `DeleteUser`, not the update path. Role assignment / role CRUD are `RequireGlobalAdmin` (`backend/pkg/authz/permissions.go:27-33`), proving `users:update` is intended below admin.\n\n## Impact\nComplete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated `users:update` permission.\n\n## Proof of Concept\n1. Admin delegates a custom \"User Manager\" role with `users:update`.\n2. `PUT /users/{adminId}` with `{\"password\":\"attacker123\"}`.\n3. `POST /auth/login {\"username\":\"arcane\",\"password\":\"attacker123\"}` → admin session.\n\n## Attack Chain\n1. Action: admin delegates custom role with `users:update`. Guard: role creation is `RequireGlobalAdmin`. Bypass: intended delegation (holder is meant to manage profiles, not seize admin).\n2. Action: `PUT /users/{adminId}` `{\"password\":\"attacker123\"}`. Guard: `RequirePermission(users:update)` (`users.go:154`). Bypass: holder has it; no hierarchy check (`users.go:317-323`, `user_service.go:174` unconditional Save).\n3. Action: `POST /auth/login` as admin → admin session.\n\n## Bypass Evidence\n- `users.go:317-323` sets `PasswordHash` for any target; `user_service.go:174-194` has no actor/target privilege comparison.\n- Only `IsGlobalAdmin` hits are `DeleteUser`'s last-admin guard and DTO flags (grep).\n- `users:update` is org-level, held by no built-in non-admin role (`permissions.go:24`).\n\n## Affected Versions\n`<= 2.5.0`.\n\nReported by **zx (Jace)** — GitHub: @manus-use","categories":["Libraries & packages"],"product":"github.com/getarcaneapp/arcane/backend/v2","vendor":"getarcaneapp","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-pw5q-rjx4-7f7p","source_modified_at":"2026-10-16T21:15:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/getarcaneapp/arcane/backend/v2"},"range":"< 2.6.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96627","source_modified_at":"2026-10-19T14:34:05.584Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"arcane","vendor":"getarcaneapp","versions":[{"version":"< 2.6.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-pw5q-rjx4-7f7p","source_modified_at":"2026-10-19T21:40:44.932520248Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/getarcaneapp/arcane/backend/v2","purl":"pkg:golang/github.com/getarcaneapp/arcane/backend/v2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.6.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-pw5q-rjx4-7f7p","source_modified_at":"2026-10-16T21:15:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/getarcaneapp/arcane/backend/v2"},"version":"2.6.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-pw5q-rjx4-7f7p","source_modified_at":"2026-10-19T21:40:44.932520248Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/getarcaneapp/arcane/backend/v2","purl":"pkg:golang/github.com/getarcaneapp/arcane/backend/v2"},"version":"2.6.0"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0029,"percentile":0.20418,"score_date":"2026-10-23"},"published_at":"2026-10-16T21:13:16.717Z","modified_at":"2026-10-19T21:40:44.932520248Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-pw5q-rjx4-7f7p","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-16T21:15:06Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-96627","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T14:34:05.584Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-pw5q-rjx4-7f7p","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T21:40:44.932520248Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96627","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/pull/3426","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-pw5q-rjx4-7f7p","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-19T14:33:08.031435Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T21:40:44.932520248Z","content_hash":"527f7a9d9ebb060ff07d4fce1d236f723837a02fe068172c463d40ec2969d6dd"}}