WS-2026-0070

ArangoDB unauthenticated authentication bypass through inconsistent raw versus decoded URL handling. With the default --server.authentication-system-only, CommTask::canAccessPath tested the raw request path, so a URL-encoded underscore such as /%5Fapi/... failed the path1 != '' system-path test,...