{"id":"GHSA-x8mg-6r4p-87pf","title":"ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization","summary":"ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization","severity":"high","cwe":["CWE-200","CWE-285"],"vendor":"arcadedb","product":"com.arcadedb:arcadedb-server","ecosystem":"maven","affected":["com.arcadedb:arcadedb-server < 26.7.2"],"patched":["com.arcadedb:arcadedb-server 26.7.2"],"published":"2026-07-16","updated":"2026-07-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x8mg-6r4p-87pf","references":[{"url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf"},{"url":"https://github.com/ArcadeData/arcadedb/releases/tag/26.7.2"},{"url":"https://github.com/advisories/GHSA-x8mg-6r4p-87pf"}],"tags":["ghsa","maven"],"ingestedAt":"2026-07-16T20:58:02.623Z","slug":"GHSA-x8mg-6r4p-87pf","body":"## Overview\n\nAbout 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler (which holds the only per-database gate at DatabaseAbstractHandler.java:69,88-90). Affected: PostBatchHandler:129, PostTimeSeriesWriteHandler:115, PostPrometheusWriteHandler:83, PostTimeSeriesQueryHandler:69, GetTimeSeriesLatestHandler:58, PostGrafanaQueryHandler:69, GetGrafanaHealthHandler:49, GetGrafanaMetadataHandler:52, GetPromQLQueryHandler:63, GetPromQLQueryRangeHandler:71, GetPromQLLabelsHandler:56, GetPromQLLabelValuesHandler:62, GetPromQLSeriesHandler:72, PostPrometheusReadHandler:85. The engine fallback is also void: LocalDatabase.checkPermissionsOnDatabase:711 early-returns when getCurrentUser()==null.\n\nExploit: a user authorized only for DB 'a' calls POST /api/v1/batch/b, POST /api/v1/ts/b/write, GET /api/v1/ts/b/prom/api/v1/query, POST /api/v1/ts/b/query -> full read AND write of DB 'b' (200 OK). The equivalent /api/v1/command/b correctly returns 403.\n\nFix: re-parent these handlers to DatabaseAbstractHandler, or add a shared resolveAuthorizedDatabase() choke point that enforces canAccessToDatabase and sets the engine principal before getDatabase(...). Fail closed when the security context is absent.\n\n## Affected packages\n\n- `com.arcadedb:arcadedb-server < 26.7.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `com.arcadedb:arcadedb-server 26.7.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}