Executive brief
ArcadeDB is a multi-model database platform. Versions before 26.7.2 contain an authorization flaw in time series, batch, Prometheus, and Grafana API endpoints that fail to validate database access permissions. An attacker with access to one database can read and modify other databases they should not have access to, potentially exposing sensitive data or disrupting operations.
Technical details
This is an insecure direct object reference (IDOR) vulnerability in approximately 14 HTTP handlers that resolve a database parameter from the URL path and call getDatabase(...) without first invoking the canAccessToDatabase(...) authorization check. The affected handlers extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler, which enforces per-database authorization gates. An authenticated user authorized for database 'a' can directly access and manipulate database 'b' by calling endpoints like POST /api/v1/batch/b or POST /api/v1/ts/b/write, receiving 200 OK responses. The engine's fallback permission check in LocalDatabase.checkPermissionsOnDatabase returns early when no security context exists, providing no protection. The vulnerability was patched in version 26.7.2 by re-parenting handlers to DatabaseAbstractHandler or adding a shared authorization checkpoint.
Affected products
- ArcadeData ArcadeDB before 26.7.2
Timeline
- 2026-07-09: disclosed
- 2026-08-01: advisory
- 2026-07-09: patched: Fix available in version 26.7.2