The flaw in Arcane’s user update routine allows a user with delegated users:update permission to set the global administrator’s password without any privilege check. The attacker can therefore replace the administrator password, log in as the administrator, and gain full control over the system. This is an example of improper authorization and privilege escalation, classified with CWE-266 and CWE-269.

Arcane, the container‑management interface from getarcaneapp, is vulnerable in all backend releases before 2.6.0. Versions 2.6.0 and later contain the fix that enforces correct privilege checks during password updates.

The CVSS score of 8.8 classifies this vulnerability as high severity. No EPSS data is available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker already have delegated users:update rights, so the threat is an internal attacker or a compromised user with that privilege. Once the privilege exists, a simple API call to change the administrator password is sufficient to seize control.