Description

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-18T12:19:35.310Z",
  "pubdate": "2026-08-18T12:19:35.310Z",
  "executiveSummary": "ArcadeDB before version 26.8.1 suffers from an authentication binding flaw in its batch and time-series HTTP handlers. This vulnerability allows an authenticated user with limited per-type privileges to bypass fine-grained access control mechanisms and perform unauthorized read and write operations on restricted database types.\nThe root cause stems from the failure to bind the authenticated principal via the setCurrentUser method on specific worker threads handling batch and time-series requests. Consequently, the engine's access control layer, implemented in LocalBucket.checkPermissionsOnFile, fails to evaluate permissions for these operations.\nThe impact is restricted to deployments utilizing per-type or per-group Access Control Lists (ACLs), whereas deployments relying solely on database-level access control remain unaffected.\nAttackers require valid database access with limited per-type permissions to exploit this vulnerability. By submitting crafted requests to the affected batch and time-series endpoints, an attacker can elevate their effective operational scope beyond their authorized permissions, undermining the security posture of multi-tenant or strictly partitioned database environments.",
  "technicalDetails": "The vulnerability resides within the HTTP request handling architecture of ArcadeDB, specifically affecting the batch and time-series HTTP handlers across versions prior to 26.8.1.\nThe root cause of the flaw is the omission of the authenticated principal binding step, specifically the setCurrentUser execution, during the initialization of worker threads assigned to batch and time-series processing.\nIn ArcadeDB's security model, fine-grained, per-type authorization checks are enforced by the LocalBucket.checkPermissionsOnFile function. This security layer depends on the presence of a properly bound authenticated principal on the active thread to evaluate whether the current user possesses the necessary permissions to access or modify a specific database type.\nBecause the batch and time-series HTTP handlers fail to bind the principal using setCurrentUser, the execution context lacks user identity context when it reaches the LocalBucket.checkPermissionsOnFile validation check. As a result, the engine bypasses the fine-grained per-type ACL evaluation entirely.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker with restricted privileges establishes network connectivity to the ArcadeDB HTTP interface. Second, the attacker crafts a malicious payload targeting the vulnerable batch or time-series endpoints. Third, the HTTP request is dispatched to a worker thread where the principal binding is omitted. Fourth, the request processes operations against database types without invoking the LocalBucket.checkPermissionsOnFile validation. Finally, the database engine executes the unauthorized read or write operations, returning the requested data or committing state changes.\nAuthentication is required to reach the vulnerable handlers, but privilege requirements are subverted due to the missing principal binding. The attack vector is exposed over the network via HTTP protocols. Deployments that do not enforce per-type or per-group ACLs and rely exclusively on coarse database-level access controls are not impacted by this bypass condition."
}