Status: Patched
This vulnerability has been verified as resolved and deployed.
Read-only users can cancel modification queries across users and databases
Summary
A database-read gate exposed a cluster-wide abort-all-write-queries operation
An ordinary authenticated user with read access to one database could invoke the special transaction abort endpoint and terminate other users' active modification queries across unrelated databases.
Root cause. RestTransactionHandler::executeAbort() exposed the /write suffix after only the common database-read check. Manager::abortAllManagedWriteTrx() then iterated every database and killed each modification query without checking Query::user() against the authenticated caller.
Remediation evidence. ArangoDB confirmed the report and committed the exact authorization fix on 9 September 2026. Commit a4ffabb adds an authorized(query.user()) predicate to the global query-kill loop and explicitly elevates only the internal hot-backup path that legitimately needs to cancel every user's writes.
CVSS Score
Vulnerability Location
Source-to-Sink Analysis
A read-only authenticated request selects the special write-transaction cancellation route.
The handler passes the current username into the manager after only the route's common database permission check.
Before the fix, the manager ignored query ownership and killed every modification query in every enumerated database.
Impact Analysis
Critical Impact
The attacker can force write-query failures and transaction rollbacks across users and databases, and can sustain write-side service degradation by repeatedly invoking the endpoint. The finding does not claim durable corruption of already committed data.
Attack Surface
The authenticated HTTP transaction API on ArangoDB single servers and coordinators with query tracking enabled.
Preconditions
The attacker needs an ordinary account with read access to any database. A victim modification query must be active; no victim query ID, username, or database access is required.
Proof of Concept
Environment Setup
Run an isolated vulnerable ArangoDB server with two databases, a victim writer, and an attacker who has read-only access to only one database.
Target Configuration
Keep query tracking enabled (the default) and start a deliberately long AQL modification query as the victim.
Exploit Delivery
Authenticate as the read-only user and send DELETE /_db/attacker_db/_api/transaction/write while the victim query is active.
Outcome
After commit a4ffabb, ordinary callers can cancel only queries authorized for their identity; the internal hot-backup path enters an explicit superuser scope for its intended global behavior.
Expected Response: The cancellation endpoint succeeds and the unrelated victim modification query terminates with a killed/cancelled error.
Run this level of analysis on your repo.
Winfunc traces source-to-sink paths, validates exploitability, and gives your team patch-ready remediation.