github.com/getarcaneapp/arcane/backend/v2 vulnerabilities (Go)

2 vulnerabilities.

• github.com/getarcaneapp/arcane/backend/v2 Go Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) CVE-2026-96627 Fix available 8.8 HighOctober 16, 2026
• github.com/getarcaneapp/arcane/backend/v2 Go Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` CVE-2026-96628 Fix available 4.3 MediumOctober 16, 2026