ArcadeDB versions prior to 26.4.2 are vulnerable to an authorization bypass, allowing authenticated users and API tokens scoped to a specific database to read, write, and mutate schema on any other database on the same server, and disabling the record-level authorization system for newly created databases.
arcadedb-server +2
authorization bypass
privilege escalation
cve-2026-44221
2r
2t
1c
updated