A critical authorization bypass in various ArcadeDB HTTP handlers allows unauthorized access to and modification of databases.

This vulnerability involves an authorization bypass through user-controlled keys in time series, batch, Prometheus, and Grafana HTTP endpoints. The application fails to validate whether the requester has the necessary permissions for the target database, allowing for unauthorized access.

Unauthorized access to database endpoints can result in the exposure of sensitive data, unauthorized modification of records, or the disruption of critical database services. Given the CVSS score of 9.8, this vulnerability poses a significant risk to the confidentiality and integrity of all databases managed by the arcadedb-server instance.

Immediate Action: Update the arcadedb-server component to version 26.7.2 or later to ensure all HTTP handlers correctly validate access permissions.

Proactive Monitoring: Monitor server access logs for anomalous requests to time series or metrics endpoints originating from unauthorized users or unexpected sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests that attempt to access restricted database endpoints without appropriate authentication tokens.

Public Exploit Available: Unknown

The lack of authorization checks on critical HTTP handlers is a severe oversight that exposes database content to unauthorized parties. It is essential to update to version 26.7.2 immediately to enforce mandatory permission validation across all affected service endpoints.