Which versions of ArcadeDB are affected by CVE-2026-67342?

ArcadeDB versions prior to 26.7.2 contain a critical authorization bypass (CVSS 9.3) with publicly available exploit code that allows attackers to access and modify any database regardless of access…. A patch is available.

How to fix or mitigate CVE-2026-67342?

Within 24 hours: Identify all ArcadeDB instances in production and development environments and document their current versions. Within 7 days: Apply vendor-released patch to ArcadeDB 26.7.2 or later on all instances and verify successful deployment. Within 30 days: Complete post-patch validation across all systems, review server logs for evidence of exploitation attempts, and audit access controls to confirm authorization boundaries are restored.

ArcadeDB CVE-2026-67342

Q: What is the CVSS score of CVE-2026-67342?

CVE-2026-67342 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51861 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-01 VulnCheck

GHSA-gj8q-6wmr-v9mq

Authentication Bypass Grafana Arcadedb Arcadedata

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable HTTP endpoints with low complexity and a fail-open authorization check (null-user early-return) justify PR:N; full cross-database read, write and data-destruction give C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 01, 2026 - 13:07 vuln.today

Analysis Generated

Aug 01, 2026 - 13:07 vuln.today

Patch available

Aug 01, 2026 - 13:01 EUVD

CVE Published

Aug 01, 2026 - 12:22 cve.org

CRITICAL 9.3

DescriptionCVE.org

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

Articles & Coverage 1

News Critical IDOR Authorization Bypass in Grafana/ArcadeDB - CVE-2026-67342 Aug 01, 2026

AnalysisAI

Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the server by supplying an arbitrary {database} parameter to the time series (/ts/*), batch, Prometheus, and Grafana HTTP handlers. Roughly 14 endpoints resolve the target database and call getDatabase(...) without invoking canAccessToDatabase(...), so a caller scoped to one database (or, per the code, potentially an anonymous request) gains full read/write over databases they were never granted. Reported by VulnCheck with a vendor patch (26.7.2) available; the GHSA advisory publishes concrete exploitation requests, and while EPSS is not provided the CVSS 4.0 base score is 9.3 (Critical). This is not in CISA KEV.

Technical ContextAI

ArcadeDB is an open-source multi-model (graph, document, key-value, time series) database that exposes a REST/HTTP API on its server component (maven com.arcadedb:arcadedb-server). The vulnerability is a CWE-639 Authorization Bypass Through User-Controlled Key: per-database access control lives solely in DatabaseAbstractHandler (the canAccessToDatabase gate at DatabaseAbstractHandler.java:69,88-90), but the affected handlers extend AbstractServerHttpHandler directly and therefore never pass through that gate, nor do they set the engine principal before calling getDatabase(...). The engine-level fallback, LocalDatabase.checkPermissionsOnDatabase:711, is also ineffective because it early-returns when getCurrentUser()==null, so authorization fails open. Affected handlers include PostBatchHandler, PostTimeSeriesWriteHandler/PostTimeSeriesQueryHandler/GetTimeSeriesLatestHandler, the Prometheus read/write and PromQL handlers (query, query_range, labels, label_values, series), and the Grafana query/health/metadata handlers. Notably the general /api/v1/command/{db} endpoint correctly returns 403, confirming the gap is specific to these unmigrated handlers.

RemediationAI

Upgrade to ArcadeDB 26.7.2, the fixed release identified in the GHSA advisory and EUVD (Vendor-released patch: 26.7.2); follow GHSA-x8mg-6r4p-87pf (https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf). The upstream fix re-parents the vulnerable handlers to DatabaseAbstractHandler (or introduces a shared resolveAuthorizedDatabase() choke point) that enforces canAccessToDatabase and sets the engine principal before getDatabase(...), failing closed when the security context is absent. If you cannot patch immediately, restrict network access to the affected endpoint families - block or reverse-proxy-deny the /api/v1/batch/*, /api/v1/ts/* (including the Prometheus/PromQL query, query_range, labels, label_values, series and write paths), and Grafana query/health/metadata routes - accepting the trade-off that batch ingestion, time series, Prometheus scraping and Grafana dashboards will stop working; alternatively confine the HTTP API to a trusted management network or enforce per-database authorization at an upstream gateway. Do not rely on server-level authentication alone, since the flaw permits cross-database access even for legitimately authenticated users.