CVE-2026-96628: Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth.

When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c).

This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator.

As a result, an environment-scoped access token can access routes protected with WithAdminRequired(), despite the corresponding EnvironmentPermissionSet intentionally containing no global or sudo permissions.

In v2.10.2, the affected admin-only surface is the manager’s Go pprof diagnostic interface under:

/api/debug/pprof/*

This exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators.

The issue is an incorrect authorization vulnerability (CWE-863).