CVE-2026-96628: CWE-863: Incorrect Authorization in getarcaneapp arcane

## Summary Arcane v2.10.2 contains an authorization inconsistency in `AuthMiddleware.managerAuth`. When a request supplies a valid environment access token through the `X-Arcane-Agent-Token` header, `managerAuth` resolves the associated environment, installs an environment-scoped permission set, and immediately calls `next(c)`. This occurs before the middleware evaluates the `AdminRequired` option and verifies that the caller is a global administrator. As a result, an environment-scoped access token can access routes protected with `WithAdminRequired()`, despite the corresponding `EnvironmentPermissionSet` intentionally containing no global or sudo permissions. In v2.10.2, the affected admin-only surface is the manager's Go `pprof` diagnostic interface under: `/api/debug/pprof/*` This exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators. The issue is an incorrect authorization vulnerability (CWE-863). ## Details ### 1. Environment access tokens are accepted by the manager authentication middleware The production authentication middleware is configured with an environment access-token resolver: `backend/internal/di/providers.go` Conceptually, the middleware is constructed as: ```go auth.NewAuthMiddleware(authService, cfg). WithApiKeyValidator(apiKey). WithEnvironmentAccessTokenResolver(env). WithPermissionResolver(role) ``` Therefore, the `X-Arcane-Agent-Token` authentication path is active in the production manager. ### 2. The environment-token path returns before authorization options are evaluated The relevant logic is in: `backend/internal/auth/middleware.go` `managerAuth` first checks the `X-Arcane-Agent-Token` header. When the token resolves to an environment, the middleware installs an environment-scoped permission set and immediately continues processing: ```go if agentToken := req.Header.Get(utils.HeaderAgentToken); agentToken != "" { if env, ok := m.resolveEnvironmentAccessToken(ctx, agentToken).Get(); ok { environmentScopedInternal(c, env) return next(c) } } ``` The important part is the unconditional: ```go return next(c) ``` The normal authentication path later evaluates the middleware's `AdminRequired` option: ```go ps := m.resolvePermissionsOrDeny(ctx, user) if m.options.AdminRequired && !ps.IsGlobalAdmin() { return c.JSON(http.StatusForbidden, common.APIError{ Code: "FORBIDDEN", Message: "You don't have permission to access this resource", }) } ``` The environment-token branch never reaches this check. Consequently, `WithAdminRequired()` has no effect when authentication succeeds through a valid environment access token. This creates an authorization inconsistency between authentication mechanisms: - normal user/session authentication → `AdminRequired` is enforced; - environment access-token authentication → `AdminRequired` is bypassed. ### 3. Environment tokens are intentionally not global-administrator credentials `backend/pkg/authz/permission_set.go` defines the effective permissions assigned to an environment access token. `EnvironmentPermissionSet(envID)` grants environment-scoped permissions only for the specified environment: ```go func EnvironmentPermissionSet(envID string) *PermissionSet { ps := NewPermissionSet() if envID == "" { return ps } for _, p := range AllPermissions() { if IsEnvScoped(p) { ps.AddEnv(envID, p) } } return ps } ``` The implementation explicitly establishes that these credentials do not receive global or sudo permissions. Therefore, an environment access token should not satisfy a global-administrator authorization requirement. The early return in `managerAuth` bypasses this intended privilege boundary. ### 4. `/api/debug/pprof/*` explicitly requires global-administrator authorization The diagnostic routes are registered in: `backend/api/ws/diagnostics.go` The `pprof` group is protected using: ```go pprofGroup := group.Group( "/debug/pprof", authMiddleware.WithAdminRequired().Add(), ) ``` The source also documents the intended authorization requirement by noting that pprof keeps the stricter admin-required gate. The group exposes handlers including: ```text /api/debug/pprof/ /api/debug/pprof/cmdline /api/debug/pprof/profile /api/debug/pprof/symbol /api/debug/pprof/trace /api/debug/pprof/heap /api/debug/pprof/goroutine /api/debug/pprof/allocs /api/debug/pprof/block /api/debug/pprof/mutex /api/debug/pprof/threadcreate ``` Named profiles are dispatched through `pprof.Handler`. Because `WithAdminRequired()` is bypassed by the environment-token branch, a valid environment access token can reach these handlers even though its permission set is not globally privileged. ### 5. Other middleware does not restore the missing authorization check The CSRF middleware recognizes `X-Arcane-Agent-Token` as a heade