Missing Authorization Affecting com.arcadedb:arcadedb-server package, versions [,26.7.2)

Affected versions of this package are vulnerable to Missing Authorization through the time-series, batch, Prometheus, and Grafana HTTP handlers in AbstractServerHttpHandler-based routes such as PostBatchHandler, PostTimeSeriesWriteHandler, PostTimeSeriesQueryHandler, GetTimeSeriesLatestHandler, and the Grafana/PromQL handlers. An attacker can read or write a different database by sending requests with that database name in the path, even when their account is authorized only for another database. These handlers resolved the {database} path parameter and opened the database without enforcing canAccessToDatabase(), so a low-privilege user could reach another database’s time-series data, batch execution, and Prometheus/Grafana query endpoints. The impact is unauthorized cross-database access, including data disclosure and data modification, with the victim database’s contents and query results exposed to the attacker.

Workarounds

• Restrict access to the affected time-series, batch, Prometheus, and Grafana endpoints to only users authorized for the target database; do not allow accounts scoped to one database to call /api/v1/batch/{db}, /api/v1/ts/{db}/write, /api/v1/ts/{db}/query, /api/v1/ts/{db}/prom/api/v1/query, or /api/v1/ts/{db}/grafana/health against other databases, as this blocks cross-database read/write access.

• GitHub Advisory
• GitHub Commit