CVE-2026-75850
Received Received - Intake

ArcadeDB Batch Handler Fails to Bind Principal Allowing ACL Bypass

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75850
EUVD
EUVD-2026-60611

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
arcadedb arcadedb to 26.7.3 (inc)
arcadedb arcadedb to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75850 is a vulnerability in ArcadeDB versions before 26.8.1 where batch and time-series HTTP handlers fail to bind the authenticated user. This causes the system to skip per-type Access Control List (ACL) checks, allowing users with limited permissions to bypass restrictions and access unauthorized data types.

Detection Guidance

To detect this vulnerability, check if your ArcadeDB version is 26.7.3 or earlier. Verify if batch and time-series HTTP handlers are accessible without proper per-type ACL enforcement. Monitor logs for unauthorized access attempts to restricted types via these endpoints.

Impact Analysis

If you use ArcadeDB with per-type or per-group ACLs, an attacker with database access but restricted permissions could exploit this to read or write to types they are not authorized to access via batch or time-series endpoints. Deployments using only database-level ACLs are unaffected.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating compliance requirements like GDPR or HIPAA that mandate strict access controls and data protection. Organizations using per-type ACLs in ArcadeDB may face compliance risks if attackers exploit this flaw.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later to fix the issue. Ensure per-type ACLs are properly enforced by binding the authenticated principal in batch and time-series handlers. Review access logs for suspicious activity and restrict database access to trusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart