CVE-2026-67342

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-639

Description

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

Affected packages

Maven

com.arcadedb:arcadedb-server

0 → 26.7.2

References

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf
https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers

Status: profiled · ingested 2026-08-04T00:00:54.000Z