# CVE-2026-93596: ArcadeDB authorization bypass in batch edge-connect async workers

Source: https://junglewise.ai/threats/cve-2026-93596-arcadedb-authorization-bypass-in-batch-edge-connect-async-workers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93596 · Severity: medium · CVSS 4.3 · Published 2026-09-18

ArcadeDB is a graph database engine that stores and manages connected data structures. An authenticated database user with limited permissions can exploit the batch edge-loading API to illegally create or modify edges in protected vertex types, circumventing role-based access controls. This allows a low-privilege user to alter graph relationships they should not have permission to touch, potentially corrupting data integrity in multi-tenant deployments that rely on per-type access controls.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-93596 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93596 being exploited in the wild.

**How severe is CVE-2026-93596?** Medium severity, with a CVSS score of 4.3, published 18 September 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB <= 26.8.1.

**Is there a fix for CVE-2026-93596?** A patch was published on 2026-09-18: Fixed in version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93596 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-93596?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) affecting the POST /api/v1/batch/{database} endpoint's parallel edge-connect phase. When parallelFlush is enabled (default true), edge-segment records are written by DatabaseAsyncTransaction async worker threads that fail to bind the authenticated principal via ThreadLocal DatabaseContext. During permission checks in LocalDatabase.checkPermissionsOnFile, a null getCurrentUser() causes an early return that allows writes, bypassing per-type CREATE_RECORD/UPDATE_RECORD ACL enforcement on target vertex types. An attacker must be authenticated with database access and hold CREATE_RECORD permission on an edge type E but have it revoked on a targeted vertex type V; they can then POST a graph batch request to durably append edges to protected vertices and mutate their edge-segment buckets. The fix (released in 26.9.1) binds the principal on DatabaseAsyncTransaction async workers; setting parallelFlush=false in the request workarounds the issue.

## Affected products

- ArcadeData ArcadeDB <= 26.8.1

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 26.9.1

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-27vw-j8qc-5h7x](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-27vw-j8qc-5h7x)
- [https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-authorization-bypass-via-batch-edge-connect](https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-authorization-bypass-via-batch-edge-connect)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)