CrateDB before versions 6.2.8 and 6.3.2 contains a flaw in its Blob HTTP API that does not check the authenticated user's privileges before performing blob read, delete, or insert operations. Consequently, any user who can authenticate to the database can access, overwrite, or delete any blob whose SHA‑1 digest is known, regardless of the database’s GRANT settings, effectively bypassing all access controls on blob tables.

The issue affects CrateDB deployments using the crate:crate product, specifically all releases before v6.2.8 and v6.3.2. Blobs stored in BLOB TABLEs are impacted; deployments that do not employ BLOB TABLEs are not affected.

The CVSS score is 7.1, indicating a moderate to high severity. The EPSS score is unavailable but the lack of listing in the CISA KEV catalog suggests no confirmed large‑scale exploitation to date. Attackers need only to be authenticated, and they must know a blob’s SHA‑1 digest, which can be discovered through existing data or by inference. Since the HTTP endpoint never consults AccessControl, an authenticated attacker can read sensitive files, delete them, or insert malicious blobs. The vulnerability relies on standard authentication mechanisms and provides a straightforward path for data exfiltration or data manipulation; therefore, it represents a significant risk to confidentiality, integrity, and availability of blob data.