CVE-2026-67341 is an incorrect authorization vulnerability in ArcadeDB affecting versions before 26.7.2. The issue arises because the database fails to enforce proper authorization checks on the SQL DEFINE FUNCTION statement when the LANGUAGE is set to js (JavaScript). As a result, any user with database access can define functions containing arbitrary JavaScript code, bypassing security controls designed to restrict scripting capabilities to administrative users only. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.

An attacker with access to the database can execute arbitrary JavaScript code by submitting specially crafted DEFINE FUNCTION statements. This bypasses the intended security controls that restrict scripting to administrators, potentially leading to unauthorized code execution within the database environment. The vulnerability does not require prior privileges or user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict database access to trusted users only and monitor for unauthorized DEFINE FUNCTION statements. Avoid granting unnecessary database access privileges to untrusted users.