CVE-2026-96627

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

GHSA-PW5Q-RJX4-7F7P Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment...

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627

The Arcane Docker management interface (versions

EUVD-2026-103178

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627: Incorrect Privilege Assignment

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

Arcane Permission Licensing and Access Control Vulnerabilities

Versions of Arcane 2.6.0 and earlier have vulnerabilities related to permission licensing and access control. These vulnerabilities arise from the UpdateUser function in backend/api/handlers/users.go, which sets a PasswordHash without comparing the caller’s permissions with the target permissions...

CVE-2026-105030

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as...

CVE-2026-105030: Exposure of Sensitive Information to an Unauthorized Actor

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as...

CVE-2026-49994

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

EUVD-2026-88401

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994: Missing Authentication for Critical Function

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

SUSE CVE-2026-73841

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead...

PT-2026-104463

Name of the Vulnerable Software and Affected Versions Kener versions 4.0.0 through 4.1.5 Description An information disclosure issue exists where unauthenticated attackers can retrieve hidden or inactive monitor data. This occurs because dashboard API handlers lack visibility filters, allowing...

CVE-2026-82283

VoltAgent through 2.1.20 contains an authorization flaw in its memory API handlers , which fail to validate conversation ownership . An authenticated attacker can supply caller-controlled identifiers to memory endpoints to read, modify, or delete conversations and messages belonging to other user...

CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...