Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

## Summary A user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by `RequireGlobalAdmin`, `users:update` is intended to sit BELOW admin (profile management); this finding defeats that separation. ## Root Cause `UpdateUser` (handler `backend/api/handlers/users.go:317-323`) loads the target by ID and sets `userModel.PasswordHash` from the request body for any user, then `userService.UpdateUser` (`user_service.go:174`) simply `tx.Save`s — with NO actor-vs-target privilege comparison. The only `IsGlobalAdmin` guard (`user_service.go:345`) is a last-admin check inside `DeleteUser`, not the update path. Role assignment / role CRUD are `RequireGlobalAdmin` (`backend/pkg/authz/permissions.go:27-33`), proving `users:update` is intended below admin. ## Impact Complete administrator account takeover (C:H/I:H/A:H) by any holder of the delegated `users:update` permission. ## Proof of Concept 1. Admin delegates a custom "User Manager" role with `users:update`. 2. `PUT /users/{adminId}` with `{"password":"attacker123"}`. 3. `POST /auth/login {"username":"arcane","password":"attacker123"}` → admin session. ## Attack Chain 1. Action: admin delegates custom role with `users:update`. Guard: role creation is `RequireGlobalAdmin`. Bypass: intended delegation (holder is meant to manage profiles, not seize admin). 2. Action: `PUT /users/{adminId}` `{"password":"attacker123"}`. Guard: `RequirePermission(users:update)` (`users.go:154`). Bypass: holder has it; no hierarchy check (`users.go:317-323`, `user_service.go:174` unconditional Save). 3. Action: `POST /auth/login` as admin → admin session. ## Bypass Evidence - `users.go:317-323` sets `PasswordHash` for any target; `user_service.go:174-194` has no actor/target privilege comparison. - Only `IsGlobalAdmin` hits are `DeleteUser`'s last-admin guard and DTO flags (grep). - `users:update` is org-level, held by no built-in non-admin role (`permissions.go:24`). ## Affected Versions `<= 2.5.0`. Reported by **zx (Jace)** — GitHub: @manus-use

Source published

16 Oct 2026 21:15:03 UTC

Source modified

19 Oct 2026 21:40:44 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Publisher rating · HIGH