CVE-2026-93596 Details
Description
ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/{database}. Because those workers have no current user, LocalDatabase.checkPermissionsOnFile returns early and allows the write, bypassing per-type CREATE_RECORD/UPDATE_RECORD ACL enforcement. In deployments that rely on per-type or per-group ACLs, an authenticated low-privilege user holding CREATE_RECORD on an edge type E but with CREATE_RECORD/UPDATE_RECORD revoked on a vertex type V can submit a graph edge-load batch request (with parallelFlush at its default value of true) and durably append edges to protected vertices of type V by writing records into V's <V>_out_edges/<V>_in_edges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the HTTP handler thread.
A vulnerability exists in ArcadeDB versions prior to 26.9.1, specifically in the 'com.arcadedb:arcadedb-engine' package, where the authenticated user principal is not properly bound to the asynchronous worker threads used in the parallel edge-connect phase of the 'POST /api/v1/batch/{database}' endpoint. This lack of binding allows for an authorization bypass, as the 'LocalDatabase.checkPermissionsOnFile' method returns early, enabling writes that circumvent the per-type 'CREATE_RECORD' and 'UPDATE_RECORD' access control list (ACL) enforcement. In environments that utilize per-type or per-group ACLs, an authenticated low-privilege user with 'CREATE_RECORD' rights on an edge type but restrictions on a vertex type can exploit this vulnerability. By default, the 'parallelFlush' option is set to true, allowing the unauthorized modification of graph adjacency by appending edges to protected vertices and altering the corresponding edge-segment buckets. This vulnerability represents an incomplete fix of a previous issue, as it only addresses the binding of the user principal on the HTTP handler thread, leaving the asynchronous worker threads unbound and vulnerable.
Users can upgrade to ArcadeDB version 26.9.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-27vw-j8qc-5h7x | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-27vw-j8qc-5h7x | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-authorization-bypass-via-batch-edge-connect | [email protected] | AdvisoryPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ArcadeDB | <= 26.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |