Executive brief
ArcadeDB is a database engine used for storing and querying graph, document, and relational data. The vulnerability allows authenticated users to bypass per-type access controls and read restricted data (including sensitive field values, record IDs, counts, and TimeSeries samples) and corrupt indexes—despite being denied permission to access those data types. This could expose confidential customer information or business metrics that should be restricted based on user roles.
Technical details
ArcadeDB enforces per-type access-control rules exclusively in the LocalBucket component, keyed on file ID. However, query-execution paths that access record data through LSM index files or the TimeSeries engine bypass this permission check entirely, leaving five distinct attack surfaces: (1) reading indexed field values and record IDs via INDEX: queries, (2) deleting index entries to desynchronize indexes and violate unique constraints, (3) reading MIN/MAX values through index shortcuts, (4) reading and counting TimeSeries samples, and (5) disclosing record counts via index queries. The attack requires only a valid authenticated account with any database access; index and type names are discoverable via unfiltered schema queries. The vulnerability affects all deployment modes (embedded and server) and all transports (HTTP, Bolt, Postgres, Gremlin). Patches are available in version 26.9.1.
Affected products
- ArcadeData ArcadeDB through 26.8.1
Timeline
- 2026-09-18: disclosed
- 2026-09-03: patched: Fixed in version 26.9.1