An authorization bypass vulnerability in ArcadeDB allows authenticated users to access or delete restricted index and TimeSeries data, posing a significant risk to data integrity and confidentiality.

The application incorrectly handles authorization checks by only enforcing access controls within the LocalBucket component. Authenticated users can leverage specific SQL statements to query indexed data and TimeSeries samples that should be restricted based on their assigned permissions.

The ability to bypass access controls allows unauthorized users to extract sensitive information from indexes and potentially corrupt database integrity by deleting index entries. With a CVSS score of 8.1, this vulnerability is considered high severity because it enables lateral data discovery and administrative manipulation of data constraints by low-privileged accounts.

Immediate Action: Upgrade the ArcadeDB engine to version 26.9.1 or later to ensure that access control checks are correctly applied across all query execution paths.

Proactive Monitoring: Review database audit logs for unusual SQL queries targeting schema indexes or TimeSeries data, particularly those originating from accounts with restricted access profiles.

Compensating Controls: If an immediate upgrade is not feasible, restrict network access to the database interfaces (HTTP, Bolt, Postgres, Gremlin) to trusted administrative segments only.

Public Exploit Available: Unknown

Given the potential for unauthorized data extraction and desynchronization of database indexes, organizations should prioritize patching this vulnerability. Administrators must upgrade to version 26.9.1 immediately to restore proper authorization enforcement and prevent exploitation of this access control weakness.