ArcadeDB versions 26.2.1 through 26.10.0 contain a missing authorization defect in the Bolt protocol handler. The flaw permits an authenticated user to set the database field in RUN or BEGIN messages and invoke commands such as db.labels() or SHOW INDEXES, enabling enumeration of schema metadata for databases other than the one the attacker is authorized to access. This effectively exposes structural information about unauthorized databases, compromising confidentiality by revealing table names, indexes, and other schema details that could assist in further attacks.

The vulnerability affects ArcadeData ArcadeDB editions from 26.2.1 up to but not including 26.10.1. Users running these versions on any platform are susceptible, as the Bolt protocol endpoint accepts database‑selection parameters without enforcing per‑database authentication.

With a CVSS score of 5.3 the issue represents moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not catalogued in CISA's Known Exploited Vulnerabilities list. The attack vector requires an attacker to first obtain valid credentials for at least one database; once logged in, they can manipulate the bolt protocol messages to read other databases’ metadata. Because the flaw resides in an authorized channel, it is unlikely to be exploitable by unauthenticated attackers without access to valid credentials.