Summary
ArcadeDB contains an authorization bypass in several HTTP handlers that do not correctly validate database access permissions.
An attacker who can reach these endpoints may access or modify databases they are not authorized to use by supplying arbitrary database parameters.
Affected context
The vulnerability appears in ArcadeDB deployments exposing HTTP handlers for time series, batch, Prometheus, and Grafana-related endpoints.
It is most relevant where these endpoints are reachable over a network and rely on database parameters passed in the request to determine which database to operate on.
In affected versions, permission checks are either missing or incomplete, allowing requests referencing arbitrary databases to proceed without confirming that the caller is authorized for those databases.
Exploit preconditions
- Attack surface: ArcadeDB HTTP endpoints for time series, batch, Prometheus, and Grafana integrations
- Required access: Network-level access to the ArcadeDB HTTP interface (e.g., from internal networks, exposed services, or misconfigured reverse proxies)
- Trigger point: Requests that include or infer a target database through query parameters, path segments, or headers
- Why exploitation is possible: The handlers rely on user-supplied database identifiers without enforcing or enforcing correctly the associated access control rules, enabling selection of unauthorized databases.
Why this happens
This issue stems from missing or insufficient server-side authorization checks when mapping incoming HTTP requests to specific databases.
The handlers accept database identifiers supplied by the client and use them directly, assuming the caller is permitted to operate on the referenced database.
This maps to CWE-639: Authorization Bypass Through User-Controlled Key, where access control is tied to an externally provided identifier instead of a securely derived or validated context, allowing attackers to pivot to resources they do not own.
Potential impact
- Unauthorized reading of data from other databases
- Unauthorized modification or deletion of records in foreign databases
- Data integrity loss across multi-tenant or multi-database deployments
- Exposure of sensitive metrics or operational data via Prometheus and Grafana endpoints
- Potential lateral movement within an environment by abusing trusted data flows
General mitigation guidance
Mitigation usually focuses on centralized, consistent authorization checks for any operation that targets a specific database or tenant.
Recommended patterns include:
- Validating that the authenticated principal is explicitly authorized for the database referenced in the request, using server-side mappings rather than trusting user-supplied identifiers.
- Consolidating access control logic so that all HTTP handlers pass through a common authorization layer, reducing the risk of unprotected paths.
- Designing APIs so that database context is derived from authenticated sessions, tokens, or configuration instead of request parameters whenever possible.
- Applying least-privilege principles to service and integration accounts, limiting which databases each integration (e.g., metrics or dashboards) can touch.
- Restricting exposure of administrative or multi-database endpoints to trusted networks or management planes only.
How teams detect issues like this
Detection can rely on both preventive and detective controls:
- Static analysis and code review: Look for handlers that accept database names or IDs from request parameters without passing through a shared authorization routine.
- Security testing: Perform authorization tests by reusing valid sessions or tokens and substituting different database identifiers to verify that access is consistently denied.
- Logging and monitoring: Enable detailed logs of database selection and access decisions; watch for patterns where a single user or integration accesses multiple unrelated databases.
- Policy enforcement: Use API gateways, WAFs, or service meshes to enforce authentication and coarse-grained authorization in front of ArcadeDB endpoints as a compensating control.
