PT-2026-67322 · Arcadedb · Arcadedb

CVE-2026-67342

·

Published

2026-07-16

·

Updated

2026-08-01

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2
Description An authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. The issue occurs because approximately 14 HTTP handlers resolve the {database} path parameter and call the getDatabase() function without verifying if the user has the required permissions via user.canAccessToDatabase() and without setting the engine principal. This happens because these handlers extend AbstractServerHttpHandler instead of DatabaseAbstractHandler, which contains the necessary security gate. Consequently, an attacker can access and modify databases they are not authorized to use by calling affected endpoints with arbitrary database parameters. Affected endpoints include:
  • /api/v1/batch/{database}
  • /api/v1/ts/{database}/write
  • /api/v1/ts/{database}/prom/api/v1/query
  • /api/v1/ts/{database}/query
Recommendations Update ArcadeDB to version 26.7.2 or later.

Exploit

Fix

Information Disclosure

IDOR

Improper Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200CWE-639CWE-285

Related Identifiers

CVE-2026-67342
GHSA-X8MG-6R4P-87PF

Affected Products

Arcadedb