CVE-2026-93593: ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission
ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to fail open.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDB TimeSeries ACL bypass (missing type-name-based access check)to a version that resolves this vulnerability.Fixed in 26.9.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege ArcadeDB user can exploit it. The attacker needs access to a TimeSeries type for which security-group type ACL entries include explicit deny rules.
Are TimeSeries deployments affected by default?
The issue concerns deployments that rely on security-group type ACL entries to deny access to TimeSeries types. The provided information does not establish whether any default configuration includes such deny rules.
What access can an attacker gain?
An attacker can read TimeSeries samples or insert new samples despite explicit deny rules. The supplied data does not indicate that deletion or modification of existing samples is possible.
How can I determine whether my deployment is affected?
Check whether ArcadeDB is before 26.9.1 and whether TimeSeries types are protected using security-group type ACL deny entries. Affected configurations may allow a low-privilege authenticated account to read from or insert into those TimeSeries types despite the configured denial.