{"metadata": {"vulnerability": "CVE-2026-96627", "count": 14, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-23T14:35:50.129Z", "date_only": false, "value": "2026-09-23T14:35:50.129Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96627", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T21:13:16.717Z", "date_only": false, "value": "2026-10-16T21:13:16.717Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96627", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T21:13:16.717Z", "date_only": false, "value": "2026-10-16T21:13:16.717Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-96627", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:15:03Z", "date_only": false, "value": "2026-10-16T21:15:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PW5Q-RJX4-7F7P", "record": "GHSA-PW5Q-RJX4-7F7P", "field": "published"}, {"timestamp": "2026-10-16T21:15:03Z", "date_only": false, "value": "2026-10-16T21:15:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PW5Q-RJX4-7F7P", "record": "GHSA-PW5Q-RJX4-7F7P", "field": "modified"}, {"timestamp": "2026-10-16T21:22:38.289Z", "date_only": false, "value": "2026-10-16T21:22:38.289441Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452685724598721", "record": "CVE-2026-96627", "field": "creation_timestamp", "uuid": "518132fd-8ba3-4a99-bfef-38db0a04ed12", "content": "CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-96627https://github.com/getarcaneapp/arcane/security/advisories/GHSA-pw5q-rjx4-7f7phttps://github.com/getarcaneapp/arcane/pull/3426https://github.com/getarcaneapp/arcane/commit/21ea962f86d967dac8ae02a050f6e5f043d10fa1https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.6.0#getarcaneapp #arcane#CVE_2026_96627#bot", "url": "https://infosec.exchange/users/cve/statuses/117452685724598721"}, {"timestamp": "2026-10-16T22:11:18.585Z", "date_only": false, "value": "2026-10-16T22:11:18.585205Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/c6etsbkwluxaz", "record": "CVE-2026-96627", "field": "creation_timestamp", "uuid": "98aaadd7-aab9-47b9-818e-747d8fd0d915", "content": "CVE-2026-96627 - Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)\nCVE ID : CVE-2026-96627\n \n Published : Oct. 16, 2026, 9:13 p.m. | 17\u00a0minutes ago\n \n Description : Arcane is an interface for managing Dock...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/c6etsbkwluxaz"}, {"timestamp": "2026-10-16T22:18:58.227Z", "date_only": false, "value": "2026-10-16T22:18:58.227", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96627", "record": "FKIE_CVE-2026-96627", "field": "published"}, {"timestamp": "2026-10-17T01:47:48.481Z", "date_only": false, "value": "2026-10-17T01:47:48.481335Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxzxvvufhl2r", "record": "CVE-2026-96627", "field": "creation_timestamp", "uuid": "430903de-0f9d-46d8-bb8c-145da45c27e4", "content": "\ud83d\udfe0 CVE-2026-96627 - High (8.8)\n\nArcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-96627/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxzxvvufhl2r"}, {"timestamp": "2026-10-19T14:33:08.031Z", "date_only": false, "value": "2026-10-19T14:33:08.031435Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96627", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-19T14:33:08.031Z", "date_only": false, "value": "2026-10-19T14:33:08.031435Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96627", "record": "FKIE_CVE-2026-96627", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-19T14:34:05.584Z", "date_only": false, "value": "2026-10-19T14:34:05.584Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96627", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T14:34:05.584Z", "date_only": false, "value": "2026-10-19T14:34:05.584Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96627", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T15:17:09.873Z", "date_only": false, "value": "2026-10-19T15:17:09.873", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96627", "record": "FKIE_CVE-2026-96627", "field": "lastModified"}]}