VULNERABILITY INTELLIGENCE
CVE-2026-67342
CVSS score9.3 CRITICAL
EPSS probability0.54%
CISA KEVNot currently listed
Published2026-08-01
Last modified2026-10-23
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.
Weakness classification
- CWE-639: Authorization Bypass Through User-Controlled Key