EUVD-2026-60611
GHSA-4h2x-5rvm-qq8v
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Batch/time-series endpoints are network-reachable (AV:N); high complexity because per-type ACL configuration must be present (AC:H); requires authenticated database session (PR:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.
AnalysisAI
Batch and time-series HTTP handlers in ArcadeDB before 26.8.1 omit the setCurrentUser call when dispatching work to worker threads, causing the fine-grained per-type ACL layer to silently skip authorization checks for those endpoints. Authenticated users with restricted per-type permissions can read from and write to data types they are not authorized to access by routing requests through the affected handlers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Four specific conditions must all be present: (1) the attacker must hold a valid ArcadeDB database-level credential - unauthenticated access is not possible; (2) the target ArcadeDB instance must be configured with per-type or per-group ACLs, not merely database-level access control - the vendor explicitly states deployments using only database-level control are not affected; (3) the attacker's credential must have database access but lack permission to one or more specific types that they wish to access; (4) the attacker must have network access to the ArcadeDB HTTP API and knowledge of the restricted type name. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N accurately captures the bounded nature of this flaw: the attacker must hold a valid database credential (PR:L), the target instance must be configured with per-type or per-group ACLs (AT:P, which the vendor explicitly confirms is the only affected configuration), and the impact is limited to low confidentiality and integrity effects with no availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated ArcadeDB user with a credential scoped to limited per-type permissions submits an HTTP request to the batch or time-series endpoint specifying a restricted type name. Because the worker thread processing the request has no bound principal, LocalBucket.checkPermissionsOnFile is never invoked, and the engine processes the read or write as if no type-level restriction existed. … |
| Remediation | Upgrade ArcadeDB to version 26.8.1 or later, which corrects the principal-binding omission in the batch and time-series HTTP handlers to restore per-type ACL enforcement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today