Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

[ Description ]Official description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

[ Fixes ]Fixes and patches

• github.com/getarcaneapp/arcane/backend/v2 2.6.0Fixed version · GitHub Advisories · go package github.com/getarcaneapp/arcane/backend/v2: upgrade to 2.6.0 or later (affected < 2.6.0)

[ Packages ]Affected open-source packages

• github.com/getarcaneapp/arcane/backend/v2 goAffected < 2.6.0 · fixed in 2.6.0 · GHSA-pw5q-rjx4-7f7p

[ References ]References

• github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1
• github.com/getarcaneapp/arcane/pull/3426
• github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0
• github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p