A high-severity authorization vulnerability in ArcadeDB allows authenticated users to bypass security controls and perform unauthorized read or write operations on TimeSeries data.

This vulnerability is caused by an incorrect authorization check (CWE-863) within the ACL resolver. Because TimeSeries types lack standard record buckets, the system fails to validate permissions by type name, effectively failing open and granting unauthorized access to authenticated low-privilege users.

The ability for low-privilege users to read or insert TimeSeries samples despite explicit deny rules represents a significant risk to data integrity and confidentiality. With a CVSS score of 8.1, this flaw could lead to the unauthorized modification of sensitive time-series metrics or the exfiltration of restricted data, potentially resulting in corrupted business analytics or compliance violations.

Immediate Action: Upgrade to ArcadeDB version 26.9.1 or later, which includes the necessary type-name-based access checks to resolve the ACL bypass.

Proactive Monitoring: Review database access logs for anomalous read or write patterns involving TimeSeries types, particularly those originating from accounts with low-privilege assignments.

Compensating Controls: Implement strict network-level access controls to limit interaction with the database to trusted application service accounts, reducing the attack surface available to unauthorized or compromised low-privilege users.

Public Exploit Available: Unknown

Given the high CVSS severity and the nature of the flaw as an authorization bypass, organizations utilizing ArcadeDB must prioritize upgrading to version 26.9.1 immediately. Failure to patch allows authenticated users to circumvent security policies, undermining the entire access control framework of the database.