CVE-2026-93595 ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

CVE-2026-93595

ArcadeDB before 26.9.1 contains an access control bypass in the query_database tool exposed through AI chat endpoints. The root cause is that the tool executes queries without binding the authenticated principal to DatabaseContext , causing per-type and per-bucket ACL checks to silently no-op. Th...

CVE-2026-93595: Missing Authorization

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

PT-2026-95374

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description An access control bypass exists in the query database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to the DatabaseContext, which...