Access Control Bypass in ArcadeDB TimeSeries Feature by Vendor ArcadeDB
CVE-2026-93593

8.6HIGH

Key Information:

Vendor

Arcadedata

Status
Arcadedb
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93593?

ArcadeDB prior to version 26.9.1 has an issue where the access control list (ACL) does not properly enforce type-specific permissions for TimeSeries entries. This flaw allows authenticated low-privilege users to read or insert TimeSeries data despite explicit deny rules. The vulnerability arises because the ACL resolver builds permission sets based on bucket IDs; however, TimeSeries types do not utilize standard record buckets. Consequently, this oversight fails to apply necessary type-name-based access checks, leading to potential unauthorized data exposure.

Affected Version(s)

arcadedb 0 < 26.9.1

arcadedb 26.9.1

References

https://github.com/ArcadeData/arcadedb/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/arcadedb-before-26.9...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.