ArcadeDB Privilege Escalation via JavaScript Triggers

ArcadeDB versions prior to 26.7.3 contain a security flaw where the LocalDatabase object is bound into JavaScript trigger contexts with HostAccess.ALL. This misconfiguration allows users with the UPDATE_SCHEMA permission to execute arbitrary JavaScript code that bypasses the security manager. Specifically, an authenticated attacker can invoke sensitive methods such as getSecurity().createUser() without appropriate authorization checks. By creating a malicious database trigger, a low-privileged user can escalate their privileges to become a server-wide administrator. This vulnerability (CVE-2026-67356) represents a significant risk for environments where database schema management is delegated to non-administrative users.

Attack Chain

1. Attacker authenticates to the ArcadeDB instance with valid credentials possessing UPDATE_SCHEMA permissions.
2. Attacker interacts with the database management API or console to define a new JavaScript trigger.
3. The trigger is crafted to invoke the insecurely bound LocalDatabase object.
4. The JavaScript execution context uses HostAccess.ALL, providing the script unrestricted access to core internal objects.
5. The attacker's script calls getSecurity().createUser() to provision a new administrative user.
6. The application fails to enforce permission checks during the method invocation due to the exposed context.
7. A new account with administrative privileges is created.
8. Attacker authenticates with the newly created admin account to achieve full server compromise.

Impact

Successful exploitation of this vulnerability allows an attacker to gain full administrative control over the ArcadeDB server. This can lead to complete data exfiltration, unauthorized modification or deletion of all databases, and persistent access to the underlying infrastructure. Organizations relying on ArcadeDB for critical data storage are at high risk if schema modification permissions are assigned to users who are not fully trusted.

Recommendation

1. Upgrade ArcadeDB to version 26.7.3 or later immediately to restrict HostAccess bindings in JavaScript contexts.
2. Review current user role assignments and revoke UPDATE_SCHEMA permissions from any user accounts that do not require them.
3. Audit database triggers for suspicious JavaScript code that interacts with the getSecurity() or createUser() methods.