ArcadeDB server versions up to 26.7.3 have an improper privilege management vulnerability where asynchronous command worker threads do not inherit the authenticated user's context. This allows users with read-only access to execute asynchronous JavaScript commands with unrestricted host access, enabling them to escalate privileges and create server-wide administrators. The issue is fixed in version 26.8.1.
ArcadeDB versions before 26.8.1 have a missing authorization issue in their batch and time-series HTTP handlers. These handlers fail to bind the authenticated user principal, causing the per-type access control checks to be bypassed. As a result, users with limited per-type permissions but database access can read and write data types they are not authorized to access. Deployments relying only on database-level access control are not affected. The vulnerability has a low CVSS score and no known exploits in the wild.
ArcadeDB versions up to 26.7.3 have a missing authorization vulnerability in the DELETE FUNCTION SQL statement. This flaw allows any user with database access to delete server-side functions without proper permission checks, potentially impacting the database's integrity and availability.
ArcadeDB versions 26.4.2 through 26.7.3 have an authorization bypass vulnerability in the set_server_setting MCP server-level tool. The vulnerability allows any authenticated read-only user to modify server global configuration when the allowAdmin flag is true, due to insufficient role checks. This can lead to configuration tampering or denial of service. The issue is fixed in version 26.8.1.
ArcadeDB versions before 26.8.1 have a server-side request forgery (SSRF) vulnerability in the IMPORT DATABASE command. The vulnerability arises because the security validator resolves and checks hostnames, but the actual connection re-resolves the raw URL and follows redirects. Authenticated attackers can exploit this to bypass validation using DNS rebinding or HTTP redirects, potentially accessing cloud metadata endpoints, internal services, or reading arbitrary local files on default installations.
CVE-2026-75843 is a critical vulnerability in ArcadeData's arcadedb prior to version 26.8.1. The flaw involves improper privilege management where the authenticated principal is not correctly bound on the gRPC transaction executor thread during beginTransaction. This allows authenticated users with reader privileges to bypass scripting authorization checks and execute unrestricted JavaScript commands. Exploitation can lead to creation of server-wide administrator accounts, severely compromising the database server.
ArcadeDB versions before 26.8.1 have a path traversal vulnerability in the OpenCypher LOAD CSV FROM clause. Authenticated users with read query privileges can exploit this to read arbitrary local files on the server using the file:// protocol. This allows exfiltration of sensitive data with the server process's privileges.
ArcadeDB versions before 26.8.1 have a denial of service vulnerability in the Cypher range() function. Authenticated users can exploit this by submitting oversized range() expressions with large bounds, causing the server to exhaust heap memory and trigger OutOfMemoryError. This results in temporary service degradation or unavailability.
ArcadeDB versions prior to 26.8.1 contain a high-severity arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement. The vulnerability arises because unescaped regular expressions are used to validate package names, allowing attackers with trigger creation privileges to exploit Java.type() to access Java classes that can read arbitrary files on the host system.
ArcadeDB versions up to 26.7.3 have an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints. This flaw allows any authenticated user on a high-availability cluster to access metadata across all databases, including names, transaction IDs, and cluster topology, without proper authorization. The issue is fixed in version 26.8.1.
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access (e.g., a read-only API token) can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundary and potentially corrupting schema metadata and record routing.
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.
ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.