CVE Feed

    Dashboard / CVE / CVE-2026-93595

    CVE-2026-93595

    ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowing authenticated users to read data they are explicitly denied at the per-type level. Attackers can prompt the AI assistant to execute queries against restricted types or buckets to retrieve sensitive data that would be rejected through normal query endpoints.

    Published:Sep 18, 2026
    Last Modified:Sep 21, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.00286
    CVSS Score:6.5

    Affected Products

    Vendor
    Arcadedata
    Product
    Arcadedb

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-119577 (CVSS 7.6) — ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain a…
    CVE-2026-119576 (CVSS 5.3) — ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with onl…
    CVE-2026-119575 (CVSS 7.1) — ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authentic…
    CVE-2026-114059 (CVSS 7.7) — ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, includ…
    CVE-2026-114058 (CVSS 5.3) — ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handle…
    CVE-2026-114057 (CVSS 5.3) — ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handle…
    CVE-2026-114056 (CVSS 5.3) — ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users…
    CVE-2026-93598 (CVSS 7.1) — ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the …
    CVE-2026-93597 (CVSS 5.3) — ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DA…
    CVE-2026-93596 (CVSS 5.3) — ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High