CVE-2026-67342

Katalog CVE

CVSS 9.8 · Critical EPSS 0,54%

Kerentanan Authorization Bypass Through User-Controlled Key. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

Rincian

Terbit di NVD

1 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 44,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf
• https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers