An information disclosure vulnerability in ArcadeDB could allow an authenticated user to gain unauthorized access to sensitive server configurations.

This is an information disclosure vulnerability (CWE-200) affecting the server settings retrieval function. It requires the attacker to be an authenticated user.

Unauthorized disclosure of server settings can expose sensitive environmental data, credentials, or architectural details that aid in further attacks. While the CVSS score is 7.5, the requirement for authentication limits the attack surface compared to unauthenticated exploits.

Immediate Action: Upgrade to ArcadeDB version 26.7.3 or later to resolve the vulnerability.

Proactive Monitoring: Monitor logs for unauthorized or unexpected requests to server configuration endpoints from standard user accounts.

Compensating Controls: Apply the principle of least privilege to user accounts to ensure that only necessary users have access to sensitive configuration interfaces.

Public Exploit Available: No

Administrators should prioritize upgrading to version 26.7.3 to eliminate this information disclosure risk. Ensure that all database instances are running the latest patched version to maintain a secure environment.