{"id":"CVE-2026-93594","title":"ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id","summary":"ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or th…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-863"],"vendor":"ArcadeData","product":"arcadedb","affected":["arcadedb < 26.9.1"],"published":"2026-09-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T15:17:21.587","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93594","references":[{"url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-2c8m-q484-jv7m","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-acl-bypass-via-index-and-timeseries","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-2c8m-q484-jv7m","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-18T14:29:20.136917Z"},"ingestedAt":"2026-09-18T13:41:41.665Z","epss":0.00337,"epssPercentile":0.27286,"slug":"CVE-2026-93594","body":"## Overview\n\nArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an authenticated user who is denied readRecord/deleteRecord on a type can still, with a single ordinary SQL statement, read the type's indexed key values and record IDs (e.g. SELECT key, rid FROM INDEX:Type[field]), read MAX/MIN values via the index shortcut, read and count TimeSeries samples, learn the type's record count, and delete index entries (DELETE FROM INDEX:Type[field]), which desynchronizes the index from the data and can defeat unique constraints. Index and type names needed for exploitation are discoverable because SELECT FROM schema:indexes is unfiltered. The issue affects both embedded and server deployments and all transports (HTTP, Bolt, Postgres, Gremlin) once a principal is bound. Fixed in 26.9.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":206865,"id":"CVE-2026-93594","ts":1789742653645,"field":"exploit_available","old":"false","new":"true"}]}