This vulnerability arises from two distinct flaws in arcadedb before version 2.6.4. First, the ServerSecurityUser.getDatabaseUser() method returns a database user with an uninitialized fileAccessMap, which is interpreted as unrestricted access by the requestAccessOnFile function. Second, the ArcadeDBServer.createDatabase() method fails to invoke factory.setSecurity(...), resulting in any database created through the POST /api/v1/server {"command":"create database X"} endpoint having its record-level authorization system disabled silently. Together, these flaws enable any authenticated principal with database-specific access to bypass authorization controls and perform unauthorized schema read, write, and mutation operations across all databases on the server.

The vulnerability allows authenticated users or API tokens with access scoped to a single database to escalate privileges and access or modify schemas on any other database hosted on the same server. This leads to a complete compromise of confidentiality, integrity, and availability of all databases on the server. The CVSS 3.1 base score is 9.0 (critical), reflecting network attack vector, low attack complexity, required privileges, user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Upgrade arcadedb to version 2.6.4 or later, where this vulnerability is fixed. The vendor has released an official patch addressing the uninitialized fileAccessMap and ensuring security settings are properly applied when creating databases via the API. No alternative mitigations are indicated. Patch status is confirmed by the vendor advisory and commit reference.