# CVE-2026-67342: ArcadeDB authorization bypass in HTTP handlers

Source: https://junglewise.ai/threats/cve-2026-67342-arcadedb-authorization-bypass-in-http-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67342 · Severity: critical · CVSS 9.8 · Published 2026-08-01

ArcadeDB is a multi-model database platform. Versions before 26.7.2 contain an authorization flaw in time series, batch, Prometheus, and Grafana API endpoints that fail to validate database access permissions. An attacker with access to one database can read and modify other databases they should not have access to, potentially exposing sensitive data or disrupting operations.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb), [com.arcadedb:arcadedb-server (Maven)](https://junglewise.ai/threats/technologies/com-arcadedb-arcadedb-server). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-67342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67342 being exploited in the wild.

**How severe is CVE-2026-67342?** Critical severity, with a CVSS score of 9.8, published 1 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB before 26.7.2; com.arcadedb:arcadedb-server (Maven) ECOSYSTEM:introduced=0,fixed=26.7.2.

**Is there a fix for CVE-2026-67342?** Yes. com.arcadedb:arcadedb-server (Maven): upgrade to 26.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67342 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67342?** Check whether you run ArcadeData ArcadeDB or com.arcadedb:arcadedb-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.arcadedb:arcadedb-server (Maven): upgrade to 26.7.2 or later

  ```sh
  # set com.arcadedb:arcadedb-server to 26.7.2 in your pom.xml or build.gradle
  ```


## Technical details

This is an insecure direct object reference (IDOR) vulnerability in approximately 14 HTTP handlers that resolve a database parameter from the URL path and call getDatabase(...) without first invoking the canAccessToDatabase(...) authorization check. The affected handlers extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler, which enforces per-database authorization gates. An authenticated user authorized for database 'a' can directly access and manipulate database 'b' by calling endpoints like POST /api/v1/batch/b or POST /api/v1/ts/b/write, receiving 200 OK responses. The engine's fallback permission check in LocalDatabase.checkPermissionsOnDatabase returns early when no security context exists, providing no protection. The vulnerability was patched in version 26.7.2 by re-parenting handlers to DatabaseAbstractHandler or adding a shared authorization checkpoint.

## Affected products

- ArcadeData ArcadeDB before 26.7.2

## Identifiers

- CVE-2026-67342
- GHSA-x8mg-6r4p-87pf

## Timeline

- 2026-07-09: disclosed
- 2026-08-01: advisory
- 2026-07-09: patched: Fix available in version 26.7.2

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf)
- [https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers](https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)