Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.11.0 → 2.11.0

Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c). This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator. As a result, an environment-scoped access token can acc…

GitHub Advisory Database에서 읽기

2026. 10. 17. 오전 06:12, GitHub Advisory Database에서 "Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-96628.