Executive brief
ArcadeDB is a database server with fine-grained access controls that restrict which users can access specific data types and buckets. The AI chat assistant feature has a vulnerability that bypasses these per-type and per-bucket access controls, allowing authenticated users to read data they have been explicitly denied access to. This affects deployments that use the AI chat feature and rely on access controls to segregate data between users sharing the same database.
Technical details
This is an authorization bypass vulnerability in the ToolDispatcher.executeQuery() method used by the AI chat endpoints (/api/v1/ai/chat and /api/v1/ai/chat/stream). The tool executes database queries without binding the authenticated principal to the thread-local DatabaseContext, causing the engine's per-type and per-bucket ACL enforcement in LocalDatabase.checkPermissionsOnFile() to silently no-op. When no principal is bound, the permission check returns early without raising a SecurityException. An authenticated user can thus invoke the AI assistant to execute queries against data types or buckets they are explicitly denied at the fine-grained level, even though the same query would be rejected through normal HTTP query endpoints. The vulnerability requires the AI assistant to be configured and the attacker to be authenticated with at least database-level access. A patch is available in version 26.9.1.
Affected products
- ArcadeData ArcadeDB before 26.9.1
Timeline
- 2026-09-18: disclosed: Published in GitHub Security Advisory GHSA-chrr-vr3p-crcc
- 2026-09-18: patched: Fixed in version 26.9.1