CVE-2026-75839

MEDIUM 4.3

ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.enabled is set and the ha-raft module is loaded), any authenticated user — including one granted access to only one database or none — can enumerate the full server database registry and retrieve per-database metadata such as database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, resulting in cross-database information disclosure. Fixed in 26.8.1.

CWE	CWE-200
Vendor	arcadedata
Product	arcadedb
Published	Aug 18, 2026
Last Updated	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for arcadedata arcadedb

Be the first to know when new medium vulnerabilities affecting arcadedata arcadedb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

ArcadeData / arcadedb

0 < 26.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-79wq-w74x-74ch vulncheck.com: https://www.vulncheck.com/advisories/arcadedb-before-information-disclosure-via-cluster-endpoints

Credits

🔍 manus-use