CVE-2026-115770

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/emailverificationtoken.go to bind an email-verification token only to the user's identifier, while...

CVE-2026-115770 Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/emailverificationtoken.go to bind an email-verification token only to the user's identifier, while...

CVE-2026-115770

The OIDC provider Pocket ID versions 2.2.0 through 2.12.0 are vulnerable to an email verification bypass. The root cause lies in backend/internal/model/email_verification_token.go, where a verification token is bound to a user's identifier but is not invalidated when the account email is updated ...

PT-2026-137227

Name of the Vulnerable Software and Affected Versions Pocket ID versions 2.2.0 through 2.11.0 Description An issue exists where the SendEmailVerification function uses a token model that binds an email-verification token only to the user identifier. Because the UpdateUser function allows changing...

Linux Distros Unpatched Vulnerability : CVE-2026-102631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls...

CVE-2026-96627

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

GHSA-PW5Q-RJX4-7F7P Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment...

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

EUVD-2026-103178

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627

The Arcane Docker management interface (versions

CVE-2026-111673

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any...

EUVD-2026-102964

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any...

PT-2026-116072

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any...

CVE-2026-111673: Missing Authentication for Critical Function

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any...

CVE-2026-96627: Incorrect Privilege Assignment

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

PT-2026-116163

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 2.6.0 Description An incorrect privilege assignment exists in the backend where the UpdateUser function in backend/api/handlers/users.go allows the PasswordHash to be set for any target account without verifying if the...