CVE-2026-93596

ArcadeDB (com.arcadedb:arcadedb-engine) versions before 26.9.1 (≤ 26.8.1) suffer an authorization bypass in the parallel edge-connect phase of POST /api/v1/batch/{database}. The authenticated principal is not bound onto the DatabaseAsyncTransaction async worker threads, causing LocalDatabase.chec...