CVE-2026-75850 Overview
CVE-2026-75850 is an authorization bypass in ArcadeDB before version 26.8.1. The database engine fails to bind the authenticated principal via setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound to the worker thread, the fine-grained per-type access control layer implemented in LocalBucket.checkPermissionsOnFile never runs for these endpoints. Users holding valid database credentials but restricted per-type or per-group permissions can read and write to types outside their authorized scope. Deployments relying only on database-level access control are not affected. The weakness is classified as [CWE-862] Missing Authorization.
Critical Impact
Low-privileged authenticated users can bypass per-type and per-group ACLs to read or modify data in restricted types via the batch and time-series endpoints.
Affected Products
- ArcadeDB versions prior to 26.8.1
- Deployments configured with per-type ACLs
- Deployments configured with per-group ACLs
Discovery Timeline
- 2026-08-18 - CVE-2026-75850 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-75850
Vulnerability Analysis
ArcadeDB enforces per-type authorization by evaluating the current user context inside LocalBucket.checkPermissionsOnFile. That check depends on a principal previously bound to the worker thread through setCurrentUser. The batch and time-series HTTP handlers omit this binding step. Requests routed to those handlers therefore execute against the storage layer without an active security principal.
With no principal bound, the per-type ACL evaluation short-circuits and no authorization decision is applied to the target type. Database-level authentication still occurs, so unauthenticated access is not possible. The bypass surfaces only when finer-grained controls are expected to constrain a database user.
Exploitation grants unauthorized read and write access to restricted types. This undermines least-privilege designs where multiple tenants or roles share a single database with per-type isolation.
Root Cause
The root cause is missing security context propagation on specific HTTP handlers. The batch and time-series endpoints do not call setCurrentUser before dispatching operations to the storage engine. LocalBucket.checkPermissionsOnFile treats the absent principal as a non-enforceable state rather than denying access by default.
Attack Vector
An attacker requires valid database credentials with limited per-type or per-group permissions. The attacker submits crafted requests to the batch or time-series HTTP endpoints referencing types they are not authorized to access. The handler executes the operations without invoking the ACL check, returning data or persisting writes to the restricted types.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-c23x-pqcj-7hfm and the Vulncheck Advisory for ArcadeDB for handler-level details.
Detection Methods for CVE-2026-75850
Indicators of Compromise
- HTTP requests to ArcadeDB batch endpoints from accounts that hold only limited per-type permissions.
- HTTP requests to time-series endpoints referencing types outside the caller's ACL scope.
- Database audit records showing writes to restricted types with no corresponding ACL evaluation entry.
Detection Strategies
- Correlate authenticated ArcadeDB HTTP sessions with the types accessed and flag operations against types outside the user's ACL grants.
- Alert on batch and time-series handler traffic from principals that historically use only database-level query endpoints.
- Compare request payloads against the authenticated user's authorized type list to identify divergence.
Monitoring Recommendations
- Enable request logging on all ArcadeDB HTTP endpoints, including batch and time-series routes.
- Forward ArcadeDB audit and access logs to a centralized SIEM for correlation with identity data.
- Baseline normal per-user type access patterns and alert on deviations after upgrade or configuration change.
How to Mitigate CVE-2026-75850
Immediate Actions Required
- Upgrade ArcadeDB to version 26.8.1 or later, which binds the authenticated principal on the affected handlers.
- Inventory ArcadeDB deployments that rely on per-type or per-group ACLs and prioritize them for patching.
- Review recent access logs for the batch and time-series endpoints to identify potential unauthorized access.
Patch Information
The issue is resolved in ArcadeDB 26.8.1. Refer to the GitHub Security Advisory GHSA-c23x-pqcj-7hfm for release notes and remediation guidance.
Workarounds
- Restrict network access to the batch and time-series HTTP endpoints using a reverse proxy or firewall rules until the upgrade is applied.
- Enforce database-level access control as the effective authorization boundary; do not rely on per-type ACLs for isolation on vulnerable versions.
- Rotate credentials for accounts that had limited per-type permissions if unauthorized access is suspected.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
