Authorization Bypass in ArcadeDB Database Engine

CVE-2026-93596

What is CVE-2026-93596?

The ArcadeDB Database Engine prior to version 26.9.1 has a serious authorization bypass vulnerability that allows authenticated low-privilege users to manipulate protected graph vertices illegally. This occurs because the system fails to bind the authenticated user's privileges to the DatabaseAsyncTransaction threads during batch processing of edge connections. This flaw allows users who have restricted permissions on vertex types to still create and update records in those vertices via a parallel edge-load batch request. Users can potentially exploit this vulnerability to modify graph structure, breaching security models dependent on Access Control Lists (ACLs). It's important to disable the parallelFlush option to mitigate this risk until a proper fix is applied.

References