CVE-2026-93593 in ArcadeDB
Summary
by MITRE • 09/18/2026
ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to fail open.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability in ArcadeDB versions prior to 26.9.1 represents a critical failure in Access Control List enforcement specifically targeting TimeSeries data types. This flaw stems from an architectural mismatch between how security permissions are resolved and the underlying storage structure of TimeSeries entities. In standard database operations, access control mechanisms typically rely on record buckets or specific object identifiers to determine user privileges. However, TimeSeries types in ArcadeDB do not utilize these conventional normal record buckets for their data persistence. Instead, they operate under a specialized internal mechanism that bypasses the standard bucket-based permission resolution logic. Consequently, when an ACL resolver attempts to validate permissions by looking up bucket IDs associated with specific security groups, it fails to find corresponding entries because TimeSeries types lack these traditional identifiers. This structural discrepancy causes the access control system to default to allowing the operation rather than denying it, effectively creating a hole in the security perimeter that allows unauthorized data manipulation and retrieval.
From an operational perspective, this vulnerability enables authenticated low-privilege users to bypass explicit deny rules designed to restrict their access levels. An attacker with minimal credentials can exploit this logic error to read sensitive TimeSeries samples or insert malicious time-series data into the database. The impact is particularly severe in environments where TimeSeries data contains critical metrics such as financial transactions, health monitoring statistics, or industrial control system telemetry. Unauthorized reading of this data constitutes a direct violation of confidentiality requirements, potentially leading to significant business intelligence leaks or regulatory non-compliance depending on the industry sector. Furthermore, the ability to insert arbitrary samples allows for potential integrity violations and availability issues through data poisoning attacks, where an attacker floods the database with false metrics that could trigger incorrect automated responses in downstream systems relying on accurate real-time analytics.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce required security group types and access controls correctly. Additionally, it maps to ATT&CK technique T1078, Valid Accounts, because the exploitation requires an authenticated user who leverages their existing but insufficient credentials to escalate privileges or bypass restrictions through logical flaws rather than credential theft. The root cause is classified under CWE-284, Improper Access Control, specifically relating to the failure of access control mechanisms to properly restrict actions based on security group types and object attributes. To mitigate this risk, organizations must immediately upgrade ArcadeDB to version 26.9.1 or later where the ACL resolver has been patched to include type-name-based access checks that correctly handle TimeSeries entities regardless of their underlying bucket structure. Until an update is applied, administrators should implement strict network-level firewalls and application-layer proxies to restrict database port accessibility exclusively to trusted IP ranges, thereby reducing the attack surface available to authenticated low-privilege users who might attempt to exploit this logic flaw.