Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-67342

ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.7.2affected
  • 26.7.2unaffected
pkg:maven/com.arcadedb/arcadedb-server

References