Is CVE-2026-93596 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93596 being exploited in the wild.

How severe is CVE-2026-93596?

Medium severity, with a CVSS score of 4.3, published 18 September 2026.

Is there a fix for CVE-2026-93596?

A patch was published on 2026-09-18: Fixed in version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93596 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93596?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93596: ArcadeDB authorization bypass in batch edge-connect async workers

CVE-2026-93596 · Severity: medium · CVSS 4.3 · Published 2026-09-18

ArcadeDB is a graph database engine that stores and manages connected data structures. An authenticated database user with limited permissions can exploit the batch edge-loading API to illegally create or modify edges in protected vertex types, circumventing role-based access controls. This allows a low-privilege user to alter graph relationships they should not have permission to touch, potentially corrupting data integrity in multi-tenant deployments that rely on per-type access controls.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-93596 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93596 being exploited in the wild.
How severe is CVE-2026-93596?: Medium severity, with a CVSS score of 4.3, published 18 September 2026.
Which products and versions are affected?: ArcadeData ArcadeDB <= 26.8.1.
Is there a fix for CVE-2026-93596?: A patch was published on 2026-09-18: Fixed in version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93596 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93596?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) affecting the POST /api/v1/batch/{database} endpoint's parallel edge-connect phase. When parallelFlush is enabled (default true), edge-segment records are written by DatabaseAsyncTransaction async worker threads that fail to bind the authenticated principal via ThreadLocal DatabaseContext. During permission checks in LocalDatabase.checkPermissionsOnFile, a null getCurrentUser() causes an early return that allows writes, bypassing per-type CREATE_RECORD/UPDATE_RECORD ACL enforcement on target vertex types. An attacker must be authenticated with database access and hold CREATE_RECORD permission on an edge type E but have it revoked on a targeted vertex type V; they can then POST a graph batch request to durably append edges to protected vertices and mutate their edge-segment buckets. The fix (released in 26.9.1) binds the principal on DatabaseAsyncTransaction async workers; setting parallelFlush=false in the request workarounds the issue.

Affected products

ArcadeData ArcadeDB <= 26.8.1

Timeline

2026-09-18: disclosed
2026-09-18: patched: Fixed in version 26.9.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.