CVE-2026-93596 ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

CVE-2026-93596 ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

CVE-2026-75850 ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...