CVE-2026-75850

MEDIUM 4.2

ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.

CWE	CWE-862
Vendor	arcadedata
Product	arcadedb
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for arcadedata arcadedb

Be the first to know when new medium vulnerabilities affecting arcadedata arcadedb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

ArcadeData / arcadedb

0 < 26.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-c23x-pqcj-7hfm vulncheck.com: https://www.vulncheck.com/advisories/arcadedb-before-per-type-acl-bypass-via-batch-handlers

Credits

🔍 manus-use