---
id: CVE-2026-67342
title: >-
  ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability
  in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints
  that fail to validate database access permissions
summary: >-
  ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability
  in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints
  that fail to validate database access permissions. Attackers can access and
  modify d…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-639
published: '2026-08-01'
updated: '2026-08-01'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67342'
references:
  - url: >-
      https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-08-02T09:18:11.649Z'
epss: 0.00319
epssPercentile: 0.25105
---

## Overview

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.