CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839: Exposure of Sensitive Information to an Unauthorized Actor

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-graphql (>=26.1.1, <=26.7.1) +11 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (>=26.1.1, <=26.7.1)

com.arcadedb:arcadedb-server MAVEN version =26.1.1, =26.2.1, =26.1.1, =26.1.1, =26.1.1, =26.4.2, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.5.1 - com.arcadedb:arcadedb-tracing 26.7.1 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-67342 Source advisory: OSV:GHSA-X8MG-6R4P-87P...