Skip to content
Threat Feed
Subscribe

Vendor

ArcadeDB

4 briefs RSS
high advisory

Missing Authorization Vulnerability in ArcadeDB DELETE FUNCTION Statement

ArcadeDB versions 26.7.3 and earlier are vulnerable to a missing authorization flaw allowing any authenticated database user to delete server-side functions via the command API.

ArcadeDB +2 vulnerability privilege-escalation database-security remote-code-execution
1r 3t 1c updated
high advisory

ArcadeDB Cross-Database IDOR Vulnerability Allows Unauthorized Data Access

ArcadeDB server versions prior to 26.7.2 are vulnerable to a cross-database Insecure Direct Object Reference (IDOR) due to improper authorization checks in several HTTP handlers, enabling a user authorized for a specific database to gain full read and write access to other unauthorized databases by directly accessing specific API endpoints.

arcadedb-server idor authorization-bypass arcadedb web-application
1r 1t
high advisory

ArcadeDB Trigger Script RCE via Java.lang.* Allow-list

A vulnerability in ArcadeDB's ScriptTriggerExecutor allows users with UPDATE_SCHEMA privileges to achieve OS Remote Code Execution (RCE) due to a permissive allow-list for trigger scripts, enabling direct calls to `java.lang.Runtime.exec()` when a malicious trigger script is created and fired.

arcadedb-engine ArcadeDB RCE vulnerability java database privilege-escalation SSRF DoS +2
3t
critical advisory

ArcadeDB Authorization Bypass Vulnerability

ArcadeDB versions prior to 26.4.2 are vulnerable to an authorization bypass, allowing authenticated users and API tokens scoped to a specific database to read, write, and mutate schema on any other database on the same server, and disabling the record-level authorization system for newly created databases.

arcadedb-server +2 authorization bypass privilege escalation cve-2026-44221
2r 2t 1c updated