CVE-2026-75850: Missing Authorization in ArcadeData arcadedb
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.
AI Analysis
Technical Summary
CVE-2026-75850 describes a missing authorization binding in ArcadeDB prior to version 26.8.1. Specifically, the authenticated principal is not set on the worker thread for batch and time-series HTTP handlers, causing the LocalBucket.checkPermissionsOnFile ACL checks to be skipped. This allows users with limited per-type permissions but database access to perform unauthorized read and write operations on restricted types through these endpoints. The vulnerability does not affect deployments that enforce access control only at the database level.
Potential Impact
Users with database access but restricted per-type permissions can bypass these restrictions on batch and time-series HTTP handlers, potentially accessing or modifying data types they should not have permission for. This could lead to unauthorized data exposure or modification in environments using per-type or per-group ACLs. The overall severity is low due to the requirement of existing database access and the presence of other access controls.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments should review their use of per-type or per-group ACLs and consider restricting access to batch and time-series HTTP endpoints or applying compensating controls. Deployments relying solely on database-level access control are not affected.
CVE-2026-75850: Missing Authorization in ArcadeData arcadedb
Description
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.
CVSS v4.0
Score 2.3low
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75850 describes a missing authorization binding in ArcadeDB prior to version 26.8.1. Specifically, the authenticated principal is not set on the worker thread for batch and time-series HTTP handlers, causing the LocalBucket.checkPermissionsOnFile ACL checks to be skipped. This allows users with limited per-type permissions but database access to perform unauthorized read and write operations on restricted types through these endpoints. The vulnerability does not affect deployments that enforce access control only at the database level.
Potential Impact
Users with database access but restricted per-type permissions can bypass these restrictions on batch and time-series HTTP handlers, potentially accessing or modifying data types they should not have permission for. This could lead to unauthorized data exposure or modification in environments using per-type or per-group ACLs. The overall severity is low due to the requirement of existing database access and the presence of other access controls.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments should review their use of per-type or per-group ACLs and consider restricting access to batch and time-series HTTP endpoints or applying compensating controls. Deployments relying solely on database-level access control are not affected.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T11:03:08.681Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a844369c6e8be0332229776
Added to database: 08/18/2026, 11:35:05 UTC
Last enriched: 08/18/2026, 11:50:22 UTC
Last updated: 08/18/2026, 14:37:47 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.