PkgSeer

Vulnerability GO-2026-6806

Unknown

5 hours ago

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend

v1.15.3 - v1.20.0

Summary

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend

Details

Arcane: Environment access token bypasses the admin-required authorization gate on /api/debug/pprof in github.com/getarcaneapp/arcane/backend

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend

v2.0.0 - v2.5.0 GO-2026-6807

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend

v2.0.0 - v2.5.0 GO-2026-6807

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

v2.0.0 - v2.5.0 GHSA-pw5q-rjx4-7f7p

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

v2.0.0 - v2.10.2 GHSA-mp22-58ff-6fhr

Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend

v1.15.3 - v1.18.1 GO-2026-5561

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

5 hours ago

Fixed (v2.11.0)

1 month ago

Last Modified

4 hours ago