Executive brief
ArcadeDB is a multi-model database engine. A security flaw in several of its web-based interfaces allows a user who has access to one database to bypass security checks and access any other database on the same server. This could lead to unauthorized viewing or modification of sensitive data across different business units or customers in a multi-tenant environment.
Technical details
Approximately 14 HTTP handlers in ArcadeDB (including those for Prometheus, Grafana, and batch operations) resolve the {database} path parameter without invoking authorization checks like user.canAccessToDatabase(). This occurs because these handlers extend AbstractServerHttpHandler directly rather than DatabaseAbstractHandler, which contains the necessary authorization logic. An authenticated attacker with access to at least one database can craft requests to these endpoints (e.g., /api/v1/batch/{database}) to perform unauthorized read and write operations on any other database on the server. The vulnerability is addressed in version 26.7.2 by ensuring all handlers enforce database authorization and fail closed if a security context is missing.
Affected products
- ArcadeData arcadedb-server < 26.7.2
Timeline
- 2026-07-09: disclosed
- 2026-07-09: patched: Released in version 26.7.2
- 2026-07-16: advisory