ArcadeDB versions prior to 26.10.2 contain an authorization flaw that allows a user who has been revoked, removed, or had their password rotated to keep reading and writing data through existing wire‑protocol connections. Because the server retains a stale user object, a compromised or previously authenticated client can continue to interact with the database even after revocation, leading to confidentiality and integrity violations.

The vulnerability affects ArcadeData’s ArcadeDB database for all releases before 26.10.2, across all supported wire protocols—including PostgreSQL, Bolt, MongoDB, and Redis. Any client that maintains a long‑lived connection to one of these protocols while being revoked is potentially impacted.

The CVSS score of 7.6 classifies this flaw as high severity. Although an EPSS score is not reported, the lack of a publicly known exploit and absence from the CISA KEV catalog suggest the risk has not yet been exploited, but the potential for misuse remains significant. Attackers who maintain an existing database session can leverage the stale authorization state to bypass revocation controls without needing additional privileges.