Access Control Bypass in ArcadeDB by Arcadedb Engine

CVE-2026-93594

What is CVE-2026-93594?

ArcadeDB through version 26.8.1 has a significant access control vulnerability that allows authenticated users to bypass permission checks. While record permissions are enforced in certain areas, queries executed via LSM index files or the TimeSeries engine do not invoke these checks. This enables users, denied permissions to read or delete specific records, to exploit single SQL statements, thereby accessing indexed key values, record IDs, and even deleting index entries, which can lead to data inconsistency. The vulnerability extends to both embedded and server deployments across all transport mechanisms including HTTP and Bolt. This issue was addressed in version 26.9.1.

References