Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-75839ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

Medium 4.3

In plain English

A medium-severity information exposure in arcadedb from ArcadeData. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.enabled is set and the ha-raft module is loaded), any authenticated user — including one granted access to only one database or none — can enumerate the full server database registry and retrieve per-database metadata such as database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, resulting in cross-database information disclosure. Fixed in 26.8.1.

Affected products (as reported)

Vendor	Product	Versions
ArcadeData	arcadedb	0 – before 26.8.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-79wq-w74x-74ch) vendor-advisory
VulnCheck Advisory: ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints third-party-advisory