Authorization Bypass in ArcadeDB via HTTP Handlers

Executive Summary

ArcadeDB versions before 26.7.2 have an authorization bypass flaw in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. These handlers do not properly check if a user has permission to access a specific database. Attackers can exploit this by sending requests with arbitrary database parameters to gain unauthorized access or modify data.

Useful 0 Not Useful 0

Detection Guidance

Check if ArcadeDB versions before 26.7.2 are running by inspecting the version in logs or configuration files. Monitor network traffic for unauthorized access attempts to time series, batch, Prometheus, or Grafana endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you use ArcadeDB versions before 26.7.2, attackers could access or alter databases they are not authorized to use. This could lead to data theft, corruption, or unauthorized modifications, potentially disrupting operations or leaking sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by allowing unauthorized access to sensitive data. It undermines data integrity and confidentiality controls, potentially leading to legal penalties, loss of trust, and regulatory fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ArcadeDB to version 26.7.2 or later immediately. Disable or restrict access to affected endpoints if not required. Implement strict access controls and validate database permissions for all HTTP handlers.

Useful 0 Not Useful 0