ArcadeDB (artifact com.arcadedb:arcadedb-engine) through version 26.8.1 enforces per-type and per-record access control only in the LocalBucket keyed on file id. However, query execution paths that access record data through LSM index files or the TimeSeries engine do not invoke these permission checks. Consequently, an authenticated user who lacks readRecord or deleteRecord permissions on a type can still execute SQL statements to read indexed key values and record IDs, retrieve MAX/MIN values via index shortcuts, read and count TimeSeries samples, learn the record count of a type, and delete index entries. Deleting index entries can desynchronize the index from the underlying data and potentially defeat unique constraints. Index and type names required for exploitation are discoverable because the query SELECT FROM schema:indexes is unfiltered. This vulnerability affects both embedded and server deployments and all transport protocols (HTTP, Bolt, Postgres, Gremlin) once a principal is bound. The issue is resolved in version 26.9.1.

An authenticated user with limited permissions can bypass intended access controls to read sensitive indexed data and metadata, and delete index entries. This can lead to unauthorized data disclosure and data integrity issues, including desynchronization of indexes and potential violation of unique constraints. The vulnerability affects all deployment types and transport protocols once authentication occurs.

Upgrade to ArcadeDB version 26.9.1 or later, where this authorization bypass vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 26.9.1.