CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.7.2 are vulnerable to an authorization bypass that allows attackers to access and modify databases without proper permissions through specific HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. This critical vulnerability, rated 9.8 on the CVSS scale, poses a significant risk to database integrity and confidentiality. Organizations using affected versions should prioritize immediate updates to mitigate potential unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.