CVE-2026-75850: Missing Authorization in ArcadeData arcadedb
ArcadeDB versions before 26.8.1 have a missing authorization issue in their batch and time-series HTTP handlers. These handlers fail to bind the authenticated user principal, causing the per-type access control checks to be bypassed. As a result, users with limited per-type permissions but database access can read and write data types they are not authorized to access. Deployments relying only on database-level access control are not affected. The vulnerability has a low CVSS score and no known exploits in the wild.
AI Analysis
Technical Summary
ArcadeDB before version 26.8.1 does not bind the authenticated principal on batch and time-series HTTP handlers. This omission prevents the engine's fine-grained per-type ACL enforcement (LocalBucket.checkPermissionsOnFile) from executing for these handlers. Consequently, users with database access but restricted per-type permissions can bypass these restrictions by submitting requests to the affected endpoints, allowing unauthorized read and write operations on data types. Deployments that enforce only database-level access control are unaffected.
Potential Impact
Users with limited per-type permissions but database access can perform unauthorized read and write operations on data types they should not access via batch and time-series HTTP endpoints. This bypass of fine-grained access controls could lead to unauthorized data exposure or modification within affected deployments. The overall severity is low, reflecting the limited scope and complexity of exploitation.
Mitigation Recommendations
A fix is available in ArcadeDB version 26.8.1 and later. Users should upgrade to version 26.8.1 or newer to ensure the authenticated principal is correctly bound and per-type ACL checks are enforced. Until upgraded, deployments relying solely on database-level access control are not impacted. No additional mitigations are specified.
CVE-2026-75850: Missing Authorization in ArcadeData arcadedb
Description
ArcadeDB versions before 26.8.1 have a missing authorization issue in their batch and time-series HTTP handlers. These handlers fail to bind the authenticated user principal, causing the per-type access control checks to be bypassed. As a result, users with limited per-type permissions but database access can read and write data types they are not authorized to access. Deployments relying only on database-level access control are not affected. The vulnerability has a low CVSS score and no known exploits in the wild.
CVSS v4.0
Score 2.3low
Affected software
ArcadeData
arcadedb
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ArcadeDB before version 26.8.1 does not bind the authenticated principal on batch and time-series HTTP handlers. This omission prevents the engine's fine-grained per-type ACL enforcement (LocalBucket.checkPermissionsOnFile) from executing for these handlers. Consequently, users with database access but restricted per-type permissions can bypass these restrictions by submitting requests to the affected endpoints, allowing unauthorized read and write operations on data types. Deployments that enforce only database-level access control are unaffected.
Potential Impact
Users with limited per-type permissions but database access can perform unauthorized read and write operations on data types they should not access via batch and time-series HTTP endpoints. This bypass of fine-grained access controls could lead to unauthorized data exposure or modification within affected deployments. The overall severity is low, reflecting the limited scope and complexity of exploitation.
Mitigation Recommendations
A fix is available in ArcadeDB version 26.8.1 and later. Users should upgrade to version 26.8.1 or newer to ensure the authenticated principal is correctly bound and per-type ACL checks are enforced. Until upgraded, deployments relying solely on database-level access control are not impacted. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T11:03:08.681Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a844369c6e8be0332229776
Added to database: 08/18/2026, 11:35:05 UTC
Last enriched: 09/11/2026, 22:19:10 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.