The vulnerability resides in the authentication middleware of Arcane. A valid environment access token can cause the middleware to skip the admin‑required check before forwarding the request. This allows an attacker to access the /api/debug/pprof endpoint, which exposes Go runtime profiling data, logs, and other diagnostic information normally protected by administrator privileges. The described weakness is an example of CWE‑863, a missing authorization check.

The flaw affects the Arcane product from getarcaneapp. All releases prior to backend v2.11.0 are susceptible. Deployments that enable the environment‑token branch and use X‑Arcane‑Agent‑Token credentials for authentication are at risk. The problem is not present in releases 2.11.0 and newer, which incorporate the fix that validates the admin flag before proceeding.

The risk is reflected in a CVSS score of 4.3 and an EPSS score that is not available, indicating limited historical exploitation data. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires possession of a valid X‑Arcane‑Agent‑Token, which could be obtained if the token is exposed or through a misconfigured environment. Attackers could therefore obtain privileged profiling data or induce performance degradation. Mitigation is best achieved by applying the vendor patch, though temporary workarounds are possible if an upgrade cannot be performed immediately.