CVE-2026-67342
CriticalCVSS 9.8Summary
ArcadeDB before version 26.7.2 contains an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Attackers can access and modify databases without proper permissions by directly calling affected endpoints with arbitrary database parameters.
Risk Assessment
The risk involves unauthorized data access and modification, potentially leading to confidentiality and integrity breaches in the ArcadeDB system.
Recommendation
Immediately upgrade ArcadeDB to version 26.7.2 or later, which fixes this vulnerability.
Original NVD description (English source)
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.