What happened
ArcadeDB's LLM-facing chat/query tool fails to propagate the authenticated user's identity into the database access-control context, so ACL restrictions configured for that user are silently bypassed when queries run through the AI chat interface instead of the standard API.
Why it matters
This is a textbook example of an AI tool integration inadvertently creating a privilege-escalation side channel: a user who is properly restricted via ACLs on the normal database API can use the AI assistant to read data they should not have access to, undermining the database's core access-control model.
Attack vector
The query_database tool exposed through ArcadeDB's AI chat endpoints executes queries without binding the authenticated principal to the DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op, letting users query and read data they are not authorized to access via the AI assistant interface.
Affected systems
ArcadeDB before 26.9.1
Mitigation
Upgrade to ArcadeDB 26.9.1 or later per GHSA-chrr-vr3p-crcc.