CVE-2026-93593

High

Description

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to fail open.

SeverityHigh

CVSS8.1

Exploit probability—

ProductArcadedata Arcadedb

PublishedSep 18, 2026

First seenSep 18, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

ArcadeData arcadedb26.9.1 or later

Vendor advisories

github.com/ArcadeData/arcadedb/security/advisories/GHSA-wjhv-79gv-2pqg

Affected products

Product	Affected versions	Fixed in
ArcadeData arcadedb	v < 26.9.1	26.9.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.