EUVD-2026-60603
GHSA-5g3q-578q-gf3m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication required (PR:L); only metadata disclosed, not record content (C:L); no integrity or availability impact; no scope change since the exposure stays within the ArcadeDB application boundary.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.enabled is set and the ha-raft module is loaded), any authenticated user - including one granted access to only one database or none - can enumerate the full server database registry and retrieve per-database metadata such as database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, resulting in cross-database information disclosure. Fixed in 26.8.1.
AnalysisAI
Cross-database information disclosure in ArcadeDB versions up to and including 26.7.3 allows any authenticated user to enumerate the full server database registry via the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate requests but perform no authorization check. Affected deployments are limited to HA clusters with arcadedb.ha.enabled configured and the ha-raft module loaded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two explicit prerequisites: (1) the target ArcadeDB instance must be deployed in high-availability mode with arcadedb.ha.enabled set and the ha-raft module loaded - this is a non-default configuration that must be deliberately enabled; (2) the attacker must hold at least one valid user credential on the ArcadeDB cluster, confirmed by the CVSS vector's PR:L designation - unauthenticated or anonymous access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately characterizes the risk: network-accessible with low attack complexity, requiring only a low-privilege credential, with limited confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains any valid ArcadeDB user credential on a target HA cluster - for example, credentials to a low-sensitivity sandbox database in a multi-tenant deployment. They then issue authenticated HTTP requests directly to the GetClusterHandler or PostBootstrapStateHandler endpoints over the network; the server verifies their identity but skips authorization checks, returning the complete database registry including names of all hosted databases, their last transaction IDs, bootstrap fingerprints, and the full Raft peer/leader topology. … |
| Remediation | Upgrade ArcadeDB to version 26.8.1 or later, which contains the vendor-released authorization fix per the security advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-79wq-w74x-74ch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today