CVE-2026-67342 — ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate da…
Published: 2026-08-01 · CVSS: 9.3 · CVSS 4.0
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7