CVE-2026-93596 affects ArcadeDB versions prior to 26.9.1 (specifically com.arcadedb:arcadedb-engine <= 26.8.1). The vulnerability is due to failure to bind the authenticated principal to asynchronous worker threads used in the parallel edge-connect phase of POST /api/v1/batch/{database}. Without the principal context, LocalDatabase.checkPermissionsOnFile prematurely returns, allowing writes that bypass per-type CREATE_RECORD/UPDATE_RECORD ACL enforcement. An authenticated user with CREATE_RECORD permission on an edge type but revoked permissions on a vertex type can exploit this to append edges to protected vertices, modifying graph adjacency without authorization. This is a partial regression of a previous fix (GHSA-c23x-pqcj-7hfm) that only bound the principal on the HTTP handler thread. Disabling parallelFlush (setting it to false) causes correct permission enforcement and request rejection.

Authenticated low-privilege users can bypass per-type and per-group ACLs to modify protected graph vertices by appending edges, resulting in unauthorized modification of graph adjacency data. This can lead to integrity violations in graph data structures where vertex permissions are intended to restrict modifications. The impact is limited to environments relying on per-type or per-group ACLs and using parallelFlush=true in batch requests.

A fixed version (26.9.1 or later) is available that addresses this issue by properly binding the authenticated principal to async worker threads. Until upgrading, setting the batch request parameter parallelFlush to false prevents exploitation by disabling the parallel edge-connect phase that triggers the vulnerability. Users should upgrade to version 26.9.1 or later to fully remediate this vulnerability.