CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.8.1 are vulnerable due to a failure to bind the authenticated user on batch and time-series HTTP handlers, allowing unauthorized access to data. This can enable users with limited permissions to read from and write to unauthorized types, posing a risk to data integrity and confidentiality. Organizations utilizing per-type or per-group access control should prioritize this vulnerability to mitigate potential unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.