CVE-2026-67342 is an authorization bypass vulnerability affecting ArcadeDB versions prior to 26.7.2. The issue exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that do not properly validate database access permissions. Attackers can exploit this flaw by directly calling these endpoints with arbitrary database parameters, enabling unauthorized access and modification of databases. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical impact with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to bypass authorization controls and gain unauthorized access to and modification rights over databases managed by ArcadeDB. This can lead to data breaches, data corruption, or denial of service affecting the confidentiality, integrity, and availability of the affected databases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected HTTP endpoints and monitor for suspicious activity related to database access. Avoid exposing these endpoints to untrusted networks.