CVE-2026-75839

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description An insecure direct object reference (IDOR) exists in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler. While these endpoints require authentication, they fail to perform proper authorization. In an ArcadeDB High Availability (HA) cluster—active when arcadedb.ha.enabled is set and the ha-raft module is loaded—any authenticated user can enumerate the full server database registry. This allows the retrieval of per-database metadata, including database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology, leading to cross-database information disclosure.

Recommendations Update to version 26.8.1.