ArcadeDB versions before 26.7.2 contain an authorization bypass in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. The handlers fail to validate database access permissions, allowing attackers to call the endpoints with arbitrary database parameters and thereby read or modify databases they normally would not be authorized to use. This flaw is a classic instance of Authority and Permission Management abuse (CWE‑639).

The affected product is ArcadeData ArcadeDB. All releases before version 26.7.2 are vulnerable. Attackers may exploit any of the exposed time series, batch, Prometheus, or Grafana endpoints by supplying arbitrary database names or identifiers.

The vulnerability has a CVSS score of 9.3, indicating a critical impact. The EPSS score is not available, but the lack of a KEV listing suggests no confirmed exploitation yet. Likely attack vectors involve remote HTTP requests to the vulnerable endpoints, requiring network reachability and the ability to set arbitrary database parameters. Because the flaw permits both data disclosure and modification, the risk to confidentiality, integrity, and availability is substantial.