CVE-2026-75853: Missing Authorization in ArcadeData arcadedb
ArcadeDB versions up to 26.7.3 have a missing authorization vulnerability in the Gremlin wire-protocol plugin. Although authentication is enforced via SASL PLAIN, the plugin does not verify database access permissions or bind the authenticated user to the engine. This allows any valid server credential, even those with limited database access, to perform read, write, and drop operations on any database on the server, bypassing access control lists. The issue is resolved in version 26.8.1.
AI Analysis
Technical Summary
The Gremlin wire-protocol plugin in ArcadeDB (com.arcadedb:arcadedb-gremlin) versions up to 26.7.3 enforces authentication but lacks authorization checks. It does not verify if the authenticated principal has permission to access the selected database, nor does it bind the principal within the engine context. Consequently, any valid server credential can access and modify any database by selecting it via a traversal-source alias, circumventing the engine's ACLs including per-type, read-only, and schema update restrictions. This vulnerability is fixed in version 26.8.1.
Potential Impact
An attacker with any valid server credential can bypass database access controls and perform unauthorized read, write, and drop operations on any database hosted by the server. This compromises data confidentiality, integrity, and availability across all databases on the affected server.
Mitigation Recommendations
Upgrade to ArcadeDB version 26.8.1 or later where this authorization issue is fixed. No other mitigations are indicated by the vendor advisory.
CVE-2026-75853: Missing Authorization in ArcadeData arcadedb
Description
ArcadeDB versions up to 26.7.3 have a missing authorization vulnerability in the Gremlin wire-protocol plugin. Although authentication is enforced via SASL PLAIN, the plugin does not verify database access permissions or bind the authenticated user to the engine. This allows any valid server credential, even those with limited database access, to perform read, write, and drop operations on any database on the server, bypassing access control lists. The issue is resolved in version 26.8.1.
CVSS v4.0
Score 8.7high
Affected software
ArcadeData
arcadedb
pkg:maven/com.arcadedb/arcadedb-gremlinRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Gremlin wire-protocol plugin in ArcadeDB (com.arcadedb:arcadedb-gremlin) versions up to 26.7.3 enforces authentication but lacks authorization checks. It does not verify if the authenticated principal has permission to access the selected database, nor does it bind the principal within the engine context. Consequently, any valid server credential can access and modify any database by selecting it via a traversal-source alias, circumventing the engine's ACLs including per-type, read-only, and schema update restrictions. This vulnerability is fixed in version 26.8.1.
Potential Impact
An attacker with any valid server credential can bypass database access controls and perform unauthorized read, write, and drop operations on any database hosted by the server. This compromises data confidentiality, integrity, and availability across all databases on the affected server.
Mitigation Recommendations
Upgrade to ArcadeDB version 26.8.1 or later where this authorization issue is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T11:03:08.681Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a844369c6e8be033222977c
Added to database: 08/18/2026, 11:35:05 UTC
Last enriched: 09/11/2026, 22:18:50 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.