What is GHSA-gj8q-6wmr-v9mq?

GHSA-gj8q-6wmr-v9mq is a security advisory published by GitHub Security Advisories with Critical severity. ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers...

Which CVE IDs does GHSA-gj8q-6wmr-v9mq cover?

GHSA-gj8q-6wmr-v9mq covers the following CVE IDs: CVE-2026-67342. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gj8q-6wmr-v9mq?

GHSA-gj8q-6wmr-v9mq has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-gj8q-6wmr-v9mqCriticalCVSS 9.8

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers...

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

August 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-67342 →

📋 Description

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

🔗 References (4)

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf
https://nvd.nist.gov/vuln/detail/CVE-2026-67342
https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers
https://github.com/advisories/GHSA-gj8q-6wmr-v9mq