ArcadeDB Authorization Bypass Vulnerabilities

ArcadeDB deployments running any version before 26.10.1 can be coerced into executing arbitrary operating-system commands by any authenticated user who can reach the POST /api/v1/command/{database} endpoint, provided the Groovy scripting engine is enabled on the instance. The root cause is a missing authorization check in GremlinQueryEngine.command(), which means role restrictions are never enforced for Gremlin-submitted Groovy code, so even an account holding the read-only 'reader' role can elevate from query access to full server-process code execution. There is no indication of active exploitation in the wild and no public exploit code identified at time of analysis, but exploitation is straightforward for an insider or anyone holding low-privilege credentials, and the attack surface is limited only by whether the Groovy engine is turned on and the API is network-reachable.

Read-only authenticated ArcadeDB accounts can persistently rewrite edge-type storage declarations because the ALTER TYPE schema-flag path skips the UPDATE_SCHEMA permission check, letting a low-privileged user flip 'lightweight' and 'unique' flags on edge types across releases 26.8.1 up to (but not including) 26.10.1. The command can be delivered as a bare ALTER TYPE edgeType WITH lightweight = true statement over the HTTP, gRPC, or Bolt command API and survives as a lasting schema change, so integrity of the graph model is affected while no data disclosure, deletion, or outage is described. The issue requires an authenticated account with at least read-only privileges (CVSS PR:L), is not remotely unauthenticated, and no public exploit code or CISA KEV entry is associated with it at time of analysis; a fixed release, 26.10.1, has been published by the vendor.

Authenticated users with credentials for any single ArcadeDB database can issue a SHOW DATABASES query over the Bolt protocol to enumerate every database name on the instance, exposing tenant or project identifiers beyond their authorized database. The issue affects ArcadeDB versions from 26.2.1 before 26.10.1 and is rooted in a missing authorization check (CWE-862) in the Bolt handler; impact is limited to database-name disclosure rather than database contents. The assessed CVSS 3.1 score is 5.3, reflecting network reachability but a requirement for valid credentials and only low confidentiality impact; no public exploit identified at time of analysis.

ArcadeDB versions 26.2.1 through 26.10.0 expose a missing authorization check in the Bolt protocol handler that lets any user holding credentials for one database read schema metadata - labels and index definitions - belonging to other databases on the same server. Because the handler trusts the attacker-supplied db field in RUN or BEGIN messages rather than validating the caller's authorization for that database, a low-privileged authenticated user can pivot across tenants with a single message field and calls to db.labels() or SHOW INDEXES. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; impact is confined to read-only information disclosure (no data content, no writes, no availability effect), so real risk concentrates in multi-database or multi-tenant deployments that depend on database-level isolation.