Skip to main content

ArcadeDB CVE-2026-67342

| EUVDEUVD-2026-51861 CRITICAL
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-01 VulnCheck GHSA-gj8q-6wmr-v9mq
Grafana Authentication Bypass Arcadedb
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Network-reachable HTTP endpoints with low complexity and a fail-open authorization check (null-user early-return) justify PR:N; full cross-database read, write and data-destruction give C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:07 vuln.today
Analysis Generated
Aug 01, 2026 - 13:07 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
CRITICAL 9.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 11 maven packages depend on com.arcadedb:arcadedb-server (11 direct, 0 indirect)

Ecosystem-wide dependent count for version 26.7.2.

DescriptionCVE.org

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

Articles & Coverage 1

News Critical IDOR Authorization Bypass in Grafana/ArcadeDB - CVE-2026-67342 Aug 01, 2026

AnalysisAI

Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the server by supplying an arbitrary {database} parameter to the time series (/ts/*), batch, Prometheus, and Grafana HTTP handlers. Roughly 14 endpoints resolve the target database and call getDatabase(...) without invoking canAccessToDatabase(...), so a caller scoped to one database (or, per the code, potentially an anonymous request) gains full read/write over databases they were never granted. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed ArcadeDB HTTP API
Delivery
Call /api/v1/batch/{db} or /ts/{db} with unauthorized database name
Exploit
Handler skips canAccessToDatabase gate
Execution
Read and write the target database (200 OK)
Impact
Exfiltrate or corrupt cross-database data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to the ArcadeDB server HTTP API and use of one of the specific affected endpoint families - the time series routes (/api/v1/ts/{database}/write, /query, /prom/api/v1/query, latest), the batch route (/api/v1/batch/{database}), the Prometheus read/write and PromQL routes, or the Grafana query/health/metadata routes - with an arbitrary {database} path parameter naming a database the caller should not access. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment All static signals point to high priority: the vendor CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H (network, low complexity, no privileges, no user interaction, full confidentiality/integrity/availability impact on the vulnerable system), scoring 9.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the ArcadeDB HTTP API (a low-privilege user authorized only for database 'a', or possibly an unauthenticated caller) sends POST /api/v1/batch/b, POST /api/v1/ts/b/write, GET /api/v1/ts/b/prom/api/v1/query, or POST /api/v1/ts/b/query targeting database 'b'. Because these handlers skip the canAccessToDatabase check, they return 200 OK and grant full read and write to database 'b'. …
Remediation Upgrade to ArcadeDB 26.7.2, the fixed release identified in the GHSA advisory and EUVD (Vendor-released patch: 26.7.2); follow GHSA-x8mg-6r4p-87pf (https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all ArcadeDB instances in production and development environments and document their current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grafana

View all
CVE-2023-34111 CRITICAL POC
9.8 Jun 06

The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
CVE-2022-26148 CRITICAL POC
9.8 Mar 21

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this

CVE-2020-27846 CRITICAL POC
9.8 Dec 21

A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2018-15727 CRITICAL POC
9.8 Aug 29

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
CVE-2024-9264 CRITICAL POC
9.4 Oct 18

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
CVE-2026-63087 CRITICAL POC
9.3 Jul 16

Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
CVE-2023-36649 CRITICAL POC
9.1 Dec 12

Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
CVE-2025-4123 HIGH POC
7.6 May 22

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
CVE-2020-13379 HIGH POC
8.2 Jun 03

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS

CVE-2023-1387 HIGH POC
7.5 Apr 26

Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability

CVE-2022-32276 HIGH POC
7.5 Jun 17

Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
CVE-2022-32275 HIGH POC
7.5 Jun 06

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-67342 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy