Skip to content
Threat Feed
Subscribe

Product

ArcadeDB

4 briefs RSS
high advisory

Missing Authorization Vulnerability in ArcadeDB DELETE FUNCTION Statement

ArcadeDB versions 26.7.3 and earlier are vulnerable to a missing authorization flaw allowing any authenticated database user to delete server-side functions via the command API.

ArcadeDB +2 vulnerability privilege-escalation database-security remote-code-execution
1r 3t 1c updated
critical advisory

Authentication Bypass and Privilege Escalation in ArcadeDB

ArcadeDB versions before 26.8.1 contain a vulnerability in the gRPC transaction executor that allows authenticated readers to execute arbitrary JavaScript, leading to server-wide privilege escalation.

ArcadeDB privilege-escalation database-security cve-2026-75843 vulnerability authentication-bypass arbitrary-file-read sandbox-bypass cve-2026-75840 +3
1r 5t 1c
high advisory

ArcadeDB Privilege Escalation via JavaScript Triggers

ArcadeDB versions before 26.7.3 insecurely expose the LocalDatabase object to JavaScript triggers, allowing attackers with schema update permissions to perform unauthorized administrative actions.

ArcadeDB +1 information-disclosure privilege-escalation database authentication-bypass database-security cve-2026-68578
1r 3t 1c
critical advisory

ArcadeDB Authorization Bypass Vulnerability

ArcadeDB versions prior to 26.4.2 are vulnerable to an authorization bypass, allowing authenticated users and API tokens scoped to a specific database to read, write, and mutate schema on any other database on the same server, and disabling the record-level authorization system for newly created databases.

arcadedb-server +2 authorization bypass privilege escalation cve-2026-44221
2r 2t 1c updated