CyberRota Analysis
AI-GeneratedArcadeDB versions up to 26.7.3 are vulnerable to an insecure direct object reference (IDOR) in the Raft cluster-info endpoints, allowing authenticated users to access sensitive metadata across the entire server database registry, even if they have restricted access. This vulnerability can lead to unauthorized information disclosure about database names, transaction IDs, and cluster topology. Organizations using ArcadeDB, particularly those with high availability clusters enabled, should prioritize upgrading to version 26.8.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.enabled is set and the ha-raft module is loaded), any authenticated user — including one granted access to only one database or none — can enumerate the full server database registry and retrieve per-database metadata such as database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, resulting in cross-database information disclosure. Fixed in 26.8.1.