CVE-2026-96628

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 2.11.0

Description An authorization inconsistency exists in the AuthMiddleware.managerAuth function. When a request uses a valid environment access token via the X-Arcane-Agent-Token header, the system installs an environment-scoped permission set and continues processing before evaluating the AdminRequired option. This allows a user with an environment-scoped token to bypass the global administrator check and access restricted routes.

Specifically, this allows unauthorized access to the Go pprof diagnostic interface at the endpoint /api/debug/pprof/*. This exposure provides access to internal runtime and diagnostic information, including goroutine stack traces, heap profiling, and CPU profiling, and may impose profiling overhead on the system.

Recommendations Update Arcane to version 2.11.0. As a temporary mitigation, restrict access to the /api/debug/pprof/* endpoint to ensure only trusted global administrators can reach it.