CVE-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

In Arcane before 2.5.0, UpdateRegistry and TestRegistry allow the registry URL to change while preserving the stored encrypted token. A user with registries:update and registries:test permissions can repoint the registry URL to an attacker-controlled host, causing the preserved token or password to be sent to that host.

Arcane prior to version 1.19.0 has a vulnerability where eight REST API endpoints related to Git repositories lack admin role verification. This allows any logged-in user with the default user role to manage Git repository configurations and exfiltrate stored credentials (PATs, SSH keys) by repointing a repository to an attacker-controlled host.

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.

Arcane, an interface for managing Docker containers, before version 1.19.2 contains a vulnerability due to missing admin authorization check on the PUT /api/environments/{id}/templates/variables endpoint. Any authenticated non-admin user can overwrite global environment variables used across all projects.

In Arcane 1.18.1 and earlier, the GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitizer blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.

In Arcane prior to version 1.18.0, four GET endpoints under /api/templates* lack authentication, allowing unauthenticated clients to read the full Compose YAML and .env content of every template, including sensitive data such as database passwords and API keys.

The Arcane plugin for WordPress contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.6.6.