Executive brief
ArcadeDB is a graph database engine that stores and manages connected data structures. An authenticated database user with limited permissions can exploit the batch edge-loading API to illegally create or modify edges in protected vertex types, circumventing role-based access controls. This allows a low-privilege user to alter graph relationships they should not have permission to touch, potentially corrupting data integrity in multi-tenant deployments that rely on per-type access controls.
Technical details
The vulnerability is a missing authorization check (CWE-862) affecting the POST /api/v1/batch/{database} endpoint's parallel edge-connect phase. When parallelFlush is enabled (default true), edge-segment records are written by DatabaseAsyncTransaction async worker threads that fail to bind the authenticated principal via ThreadLocal DatabaseContext. During permission checks in LocalDatabase.checkPermissionsOnFile, a null getCurrentUser() causes an early return that allows writes, bypassing per-type CREATE_RECORD/UPDATE_RECORD ACL enforcement on target vertex types. An attacker must be authenticated with database access and hold CREATE_RECORD permission on an edge type E but have it revoked on a targeted vertex type V; they can then POST a graph batch request to durably append edges to protected vertices and mutate their edge-segment buckets. The fix (released in 26.9.1) binds the principal on DatabaseAsyncTransaction async workers; setting parallelFlush=false in the request workarounds the issue.
Affected products
- ArcadeData ArcadeDB <= 26.8.1
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 26.9.1