{"id":"ghsa-ghsa-mp22-58ff-6fhr","seq":2448,"kind":"advisory","title":"Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`","url":"https://github.com/advisories/GHSA-mp22-58ff-6fhr","permalink":"https://vulnpulse.app/items/ghsa-ghsa-mp22-58ff-6fhr","summary":"影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.11.0 → 2.11.0\nSummary Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c). This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator. As a result, an environment-scoped access token can acc…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-96628"],"tags":["GHSA-mp22-58ff-6fhr","github.com/getarcaneapp/arcane/backend/v2"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-16T21:12:03.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}