CVE-2026-75839
Received Received - Intake

Insecure Direct Object Reference in ArcadeDB Server

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.enabled is set and the ha-raft module is loaded), any authenticated user — including one granted access to only one database or none — can enumerate the full server database registry and retrieve per-database metadata such as database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, resulting in cross-database information disclosure. Fixed in 26.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75839
EUVD
EUVD-2026-60603

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)
arcadedb arcadedb From 26.7.3 (inc)
arcadedb arcadedb-server 26.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75839 is an insecure direct object reference (IDOR) vulnerability in ArcadeDB versions 26.7.3 and earlier. It affects High Availability (HA) clusters where the Raft cluster-info endpoints authenticate users but fail to authorize access properly. Authenticated users, even with limited permissions, can retrieve sensitive metadata from all databases in the cluster, including names, transaction IDs, and topology details.

Detection Guidance

To detect this vulnerability, check if your ArcadeDB server is running a version <= 26.7.3 with HA enabled. Verify if the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler) are accessible. Use curl commands to query these endpoints with valid credentials and inspect responses for cross-database metadata.

Impact Analysis

This vulnerability allows low-privileged users to gather sensitive information about other databases and cluster structure in an ArcadeDB HA environment. Attackers could use this data for reconnaissance, potentially identifying targets for further attacks or exploiting other weaknesses in the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. The information disclosure risk may violate these regulations by exposing confidential data to unauthorized users.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later immediately. If upgrading is not possible, disable the HA feature by setting arcadedb.ha.enabled=false in the configuration. Ensure proper authorization checks are implemented in cluster endpoints to restrict access based on user permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart