{"id":"CVE-2026-67342","title":"ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions","summary":"ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify d…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-639"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67342","references":[{"url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-08-02T09:18:11.649Z","epss":0.00319,"epssPercentile":0.25022,"slug":"CVE-2026-67342","body":"## Overview\n\nArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}