ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fa…

ArcadeDB versions prior to 26.7.2 contain an authorization bypass vulnerability affecting HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. These endpoints fail to validate database access permissions, allowing unauthenticated or unauthorized attackers to access and modify databases by directly calling the affected endpoints with arbitrary database parameters. The vulnerability enables both unauthorized data access and data modification, posing a significant risk to confidentiality and integrity. A fix is available in ArcadeDB version 26.7.2 and later. The issue has been documented by NVD, GitHub Security Advisories, and VulnCheck.