CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.9.1 are vulnerable due to inadequate enforcement of access control lists (ACLs) for TimeSeries types, allowing authenticated low-privilege users to bypass restrictions and read or insert TimeSeries samples. This vulnerability arises from the ACL resolver's reliance on bucket IDs, which do not apply to TimeSeries types, leading to permission checks that fail open. Organizations using ArcadeDB should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to fail open.