Is CVE-2026-96627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96627 being exploited in the wild.

How severe is CVE-2026-96627?

High severity, with a CVSS score of 8.8, published 16 October 2026.

Which products and versions are affected?

github.com/getarcaneapp/arcane/backend (Go) SEMVER:introduced=0; github.com/getarcaneapp/arcane/backend/v2 (Go) < 2.6.0, SEMVER:introduced=0,fixed=2.6.0; Arcane <= 2.5.0.

Is there a fix for CVE-2026-96627?

Yes. github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96627 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96627?

Check whether you run github.com/getarcaneapp/arcane/backend (Go), github.com/getarcaneapp/arcane/backend/v2 (Go) or Arcane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96627: Arcane users:update permission allows admin account takeover via password reset

Q: Is there a fix for CVE-2026-96627?

Yes. github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96627 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-96627?

Check whether you run github.com/getarcaneapp/arcane/backend (Go), github.com/getarcaneapp/arcane/backend/v2 (Go) or Arcane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96627 · Severity: high · CVSS 8.8 · Published 2026-10-16

Arcane is an access-control and identity management system. A delegated "User Manager" role with users:update permission can reset the global administrator's password and take over the admin account, because the UpdateUser handler performs no privilege hierarchy check before changing any user's password. An attacker with this permission can completely compromise administrative access.

Technologies: github.com/getarcaneapp/arcane/backend (Go). Vendors: Go.

Quick answers

Is CVE-2026-96627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96627 being exploited in the wild.
How severe is CVE-2026-96627?: High severity, with a CVSS score of 8.8, published 16 October 2026.
Which products and versions are affected?: github.com/getarcaneapp/arcane/backend (Go) SEMVER:introduced=0; github.com/getarcaneapp/arcane/backend/v2 (Go) < 2.6.0, SEMVER:introduced=0,fixed=2.6.0; Arcane <= 2.5.0.
Is there a fix for CVE-2026-96627?: Yes. github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96627 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96627?: Check whether you run github.com/getarcaneapp/arcane/backend (Go), github.com/getarcaneapp/arcane/backend/v2 (Go) or Arcane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.6.0 or later
```
go get github.com/getarcaneapp/arcane/backend/v2@v2.6.0
```

Technical details

The UpdateUser handler in backend/api/handlers/users.go (lines 317–323) sets a target user's PasswordHash from the request body without comparing caller and target privilege levels. The downstream userService.UpdateUser (user_service.go:174) performs an unconditional database save with no actor-vs-target authorization check. Although role assignment and role CRUD are guarded by RequireGlobalAdmin, users:update is intended as a lower privilege for profile management only. An attacker holding the delegated users:update permission can exploit this to reset the admin account's password via PUT /users/{adminId}.

Affected products

Arcane <= 2.5.0

Identifiers

CVE-2026-96627
GHSA-pw5q-rjx4-7f7p
GO-2026-6807

Timeline

2026-10-16: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.