EUVD-2026-82912
GHSA-46xr-4762-9x3m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity ACL fail-open needing only a low-privilege account (PR:L); read and insert of protected TimeSeries data give C:H/I:H, no availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to fail open.
AnalysisAI
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before 26.9.1 even when security-group ACL deny rules explicitly forbid it, because the permission resolver builds its grants from record bucket IDs while TimeSeries types own no normal record buckets, causing the access check to fail open. The flaw is a genuine authorization bypass (CWE-863) with high confidentiality and integrity impact but no availability impact, and it only manifests on instances that actually use TimeSeries types and rely on ACLs to segregate them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid but low-privilege authenticated account on the ArcadeDB instance (PR:L) and the presence of TimeSeries types governed by security-group ACL deny rules - the bypass only manifests for TimeSeries types, which do not own normal record buckets, so deployments that do not use TimeSeries types or do not rely on ACLs to restrict them are unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authorization flaw (CWE-863) rather than a hollow high-CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ArcadeDB to 26.9.1 or later, the vendor-released fix for the SecurityGroup ACL resolution path (see the GitHub advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-wjhv-79gv-2pqg and the VulnCheck advisory at https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-timeseries-acl-bypass-via-type-permission). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which ArcadeDB instances run TimeSeries types and rely on security-group ACLs to segregate them, and treat those as the priority population; validate that no untrusted or broad low-privilege accounts hold access to the database, and temporarily tighten account provisioning or restrict network reachability to those instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today