CVE-2026-93594 Details
Description
ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an authenticated user who is denied readRecord/deleteRecord on a type can still, with a single ordinary SQL statement, read the type's indexed key values and record IDs (e.g. SELECT key, rid FROM INDEX:Type[field]), read MAX/MIN values via the index shortcut, read and count TimeSeries samples, learn the type's record count, and delete index entries (DELETE FROM INDEX:Type[field]), which desynchronizes the index from the data and can defeat unique constraints. Index and type names needed for exploitation are discoverable because SELECT FROM schema:indexes is unfiltered. The issue affects both embedded and server deployments and all transports (HTTP, Bolt, Postgres, Gremlin) once a principal is bound. Fixed in 26.9.1.
A vulnerability in ArcadeDB versions through 26.8.1 allows authenticated users to bypass access control rules enforced at the record level. The issue arises because the access control checks are only applied when records are accessed through the LocalBucket. When records are accessed via LSM index files or the TimeSeries engine, the permission checks are not invoked. As a result, a user denied read or delete permissions on a specific type can still exploit this vulnerability to read indexed key values and record IDs, access TimeSeries data, learn the record count of the type, and delete index entries, thereby desynchronizing the index and potentially violating unique constraints.
Users should upgrade to ArcadeDB version 26.9.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-2c8m-q484-jv7m | CISA-ADP | AdvisoryTechnical AnalysisVendor |
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-2c8m-q484-jv7m | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-acl-bypass-via-index-and-timeseries | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ArcadeDB | <= 26.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |