ArangoDB unauthenticated authentication bypass through inconsistent raw versus decoded URL handling. With the default --server.authentication-system-only, CommTask::canAccessPath() tested the raw request path, so a URL-encoded underscore such as /%5Fapi/... failed the path[1] != '_' system-path test, was treated as a non-system Foxx path and escalated via vc->forceSuperuser(); the router then decoded the path and dispatched the request to the protected /_api endpoint with superuser rights. Affects releases up to and including 3.12.10.1; fixed in 3.12.11, where the block was removed and authorization moved into ExecContext.