{"id":"GHSA-x8mg-6r4p-87pf","summary":"ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization","details":"About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler (which holds the only per-database gate at DatabaseAbstractHandler.java:69,88-90). Affected: PostBatchHandler:129, PostTimeSeriesWriteHandler:115, PostPrometheusWriteHandler:83, PostTimeSeriesQueryHandler:69, GetTimeSeriesLatestHandler:58, PostGrafanaQueryHandler:69, GetGrafanaHealthHandler:49, GetGrafanaMetadataHandler:52, GetPromQLQueryHandler:63, GetPromQLQueryRangeHandler:71, GetPromQLLabelsHandler:56, GetPromQLLabelValuesHandler:62, GetPromQLSeriesHandler:72, PostPrometheusReadHandler:85. The engine fallback is also void: LocalDatabase.checkPermissionsOnDatabase:711 early-returns when getCurrentUser()==null.\n\nExploit: a user authorized only for DB 'a' calls POST /api/v1/batch/b, POST /api/v1/ts/b/write, GET /api/v1/ts/b/prom/api/v1/query, POST /api/v1/ts/b/query -\u003e full read AND write of DB 'b' (200 OK). The equivalent /api/v1/command/b correctly returns 403.\n\nFix: re-parent these handlers to DatabaseAbstractHandler, or add a shared resolveAuthorizedDatabase() choke point that enforces canAccessToDatabase and sets the engine principal before getDatabase(...). Fail closed when the security context is absent.","aliases":["CVE-2026-67342"],"modified":"2026-08-02T03:56:47.048315454Z","published":"2026-07-16T20:20:22Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-16T20:20:22Z","nvd_published_at":null,"cwe_ids":["CWE-200","CWE-285"]},"references":[{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf"},{"type":"PACKAGE","url":"https://github.com/ArcadeData/arcadedb"},{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/releases/tag/26.7.2"}],"affected":[{"package":{"name":"com.arcadedb:arcadedb-server","ecosystem":"Maven","purl":"pkg:maven/com.arcadedb/arcadedb-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.7.2"}]}],"versions":["21.10.1","21.10.2","21.11.1","21.12.1","21.9.1","21.9.1-beta","22.1.1","22.1.2","22.1.3","22.10.1","22.11.1","22.12.1","22.2.1","22.8.1","22.9.1","23.1.1","23.1.2","23.10.1","23.11.1","23.12.1","23.12.2","23.2.1","23.3.1","23.4.1","23.5.1","23.6.1","23.7.1","23.9.1","24.1.1","24.10.1","24.11.1","24.11.2","24.2.1","24.4.1","24.5.1","24.6.1","25.1.1","25.10.1","25.11.1","25.12.1","25.2.1","25.3.1","25.3.2","25.4.1","25.5.1","25.6.1","25.7.1","25.8.1","25.9.1","26.1.1","26.2.1","26.2.2","26.3.1","26.3.2","26.4.2","26.5.1","26.6.1","26.7.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-x8mg-6r4p-87pf/GHSA-x8mg-6r4p-87pf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}