CVE-2026-93595Medium· 6.5▾ SunlitArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing pe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowing authenticated users to read data they are explicitly denied at the per-type level. Attackers can prompt the AI assistant to execute queries against restricted types or buckets to retrieve sensitive data that would be rejected through normal query endpoints.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114056Medium· 4.3ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
CVE-2026-114057Medium· 4.3ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
CVE-2026-114058Medium· 4.3ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
CVE-2026-93596Medium· 4.3ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/{database}
CVE-2026-54076High· 8.1ArcadeDB is a Multi-Model DBMS
CVE-2026-114059High· 7.5ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization