CVE-2026-93596: ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect
ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/{database}. Because those workers have no current user, LocalDatabase.checkPermissionsOnFile returns early and allows the write, bypassing per-type CREATERECORD/UPDATERECORD ACL enforcement. In deployments that rely on per-type or per-group ACLs, an authenticated low-privilege user holding CREATERECORD on an edge type E but with CREATERECORD/UPDATERECORD revoked on a vertex type V can submit a graph edge-load batch request (with parallelFlush at its default value of true) and durably append edges to protected vertices of type V by writing records into V's <V>outedges/<V>inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the HTTP handler thread.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
com.arcadedb:arcadedb-engineto a version that resolves this vulnerability.Fixed in 26.9.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-c23x-pqcj-7hfm - Configuration
Set parallelFlush=false for batch edge-load requests to force correct rejection and avoid the authorization bypass described for parallel edge-connect processing.
ArcadeDB batch endpoint (POST /api/v1/batch/{database}) parallelFlush = false
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using ArcadeDB versions before 26.9.1 are exposed if they rely on per-type or per-group ACLs and allow a low-privilege authenticated user to create records on an edge type while denying CREATE_RECORD or UPDATE_RECORD on a protected vertex type.
What access does an attacker need?
An attacker must be authenticated and have CREATE_RECORD permission on an edge type. They do not need permission to create or update records on the targeted vertex type.
Is the default batch configuration affected?
Yes. The affected parallel edge-connect phase runs when parallelFlush is true, which is the default value.
What can be done if upgrading is not immediately possible?
Set parallelFlush=false for graph edge-load batch requests. With parallelFlush disabled, the request is correctly rejected when the user lacks the required permissions on the vertex type.