Authorization bypass in ArcadeDB HTTP endpoint handlers (CVE-2026-67342)

ArcadeDB contains an insecure direct object reference (IDOR) vulnerability in 14 HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. These handlers resolve the database path parameter and call getDatabase() without enforcing per-database access control, because they extend AbstractServerHttpHandler directly rather than DatabaseAbstractHandler, which holds the authorization gate. An authenticated user authorized for one database can gain full read and write access to any other database by directly calling the affected endpoints with an arbitrary database parameter. Affected versions: - < 26.7.2 We recommend updating to: 26.7.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf Details: https://vuln.today/cve/CVE-2026-67342