{"action":"Upgrade github.com/getarcaneapp/arcane/backend/v2 to 2.6.0 or later.","affected":[{"fixed":"2.6.0","introduced":"0"}],"component":"github.com/getarcaneapp/arcane/backend/v2","cve_ids":["CVE-2026-96627"],"ecosystem":"Go","exploited":false,"fixed_versions":["2.6.0"],"ghsa_id":"GHSA-pw5q-rjx4-7f7p","id":"tcs_01M5JJ5BVVEDJ8C175B3F7TK33","modified_at":"2026-10-19T21:40:44.932520248Z","published_at":"2026-10-16T21:15:03Z","references":["https://osv.dev/vulnerability/GHSA-pw5q-rjx4-7f7p","https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7p","https://github.com/getarcaneapp/arcane/pull/3426","https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1","https://github.com/getarcaneapp/arcane","https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-pw5q-rjx4-7f7p","url":"https://osv.dev/vulnerability/GHSA-pw5q-rjx4-7f7p"}],"summary":"Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)"}