{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/arcadedb/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["arcadedb-server (\u003c 26.7.2)"],"_cs_severities":["high"],"_cs_tags":["idor","authorization-bypass","arcadedb","web-application"],"_cs_type":"advisory","_cs_vendors":["ArcadeDB"],"content_html":"\u003cp\u003eArcadeDB, an open-source NoSQL graph database, contains a critical Insecure Direct Object Reference (IDOR) vulnerability (GHSA-x8mg-6r4p-87pf) affecting server versions prior to 26.7.2. This flaw allows a user with valid credentials, who is authorized to access only one database, to bypass authorization checks and gain full read and write access to other, unauthorized databases within the same ArcadeDB instance. The vulnerability stems from 14 specific HTTP handlers (including those for batch operations, time-series data, Prometheus, and Grafana integrations) which directly extend \u003ccode\u003eAbstractServerHttpHandler\u003c/code\u003e instead of the secure \u003ccode\u003eDatabaseAbstractHandler\u003c/code\u003e, failing to invoke the crucial \u003ccode\u003euser.canAccessToDatabase()\u003c/code\u003e function. Exploitation of this vulnerability grants attackers unauthorized control over sensitive data across different databases, posing a significant risk of data exfiltration, manipulation, or integrity compromise. This issue directly impacts organizations using ArcadeDB for multi-tenant or segmented data storage.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Authentication\u003c/strong\u003e: An attacker obtains valid user credentials for an ArcadeDB instance, successfully authenticating and gaining authorized access to at least one specific database (e.g., 'DB A').\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eIdentify Vulnerable Endpoints\u003c/strong\u003e: The attacker identifies specific ArcadeDB HTTP API endpoints, such as \u003ccode\u003e/api/v1/batch/{db}\u003c/code\u003e, \u003ccode\u003e/api/v1/ts/{db}/write\u003c/code\u003e, or \u003ccode\u003e/api/v1/ts/{db}/prom/api/v1/query\u003c/code\u003e, which are known to be affected by the IDOR vulnerability.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCraft Malicious HTTP Request\u003c/strong\u003e: The attacker crafts an HTTP request (GET or POST) targeting one of the identified vulnerable endpoints. Crucially, the attacker substitutes the database identifier in the URL path parameter (e.g., \u003ccode\u003e{db}\u003c/code\u003e) from their authorized database ('DB A') to an unauthorized target database ('DB B').\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthorization Bypass\u003c/strong\u003e: Upon receiving the request, the ArcadeDB server's vulnerable HTTP handler (e.g., PostBatchHandler or PostTimeSeriesWriteHandler) processes the \u003ccode\u003e{database}\u003c/code\u003e path parameter without invoking the necessary \u003ccode\u003euser.canAccessToDatabase()\u003c/code\u003e authorization check.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnauthorized Database Access\u003c/strong\u003e: The server proceeds to resolve and access the target database ('DB B') despite the attacker's lack of explicit authorization for it.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePerform Unauthorized Operations\u003c/strong\u003e: The attacker successfully executes read (e.g., via \u003ccode\u003e/api/v1/ts/b/prom/api/v1/query\u003c/code\u003e) or write (e.g., via \u003ccode\u003e/api/v1/batch/b\u003c/code\u003e or \u003ccode\u003e/api/v1/ts/b/write\u003c/code\u003e) operations on the unauthorized 'DB B', receiving a \u0026quot;200 OK\u0026quot; HTTP status code.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration or Manipulation\u003c/strong\u003e: Through these unauthorized operations, the attacker gains full control over 'DB B', allowing for data exfiltration, modification, or deletion, leading to compromise of data confidentiality and integrity.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this IDOR vulnerability allows an authenticated attacker to bypass authorization controls, gaining complete read and write access to any database within the ArcadeDB instance, regardless of their assigned permissions. This leads to a severe compromise of data confidentiality and integrity across all databases. Attackers can exfiltrate sensitive information, alter critical data, or even delete entire database contents. Organizations utilizing ArcadeDB for multi-tenant environments or to segregate data by user/department are particularly at risk, as an attacker with low-privilege access to one database could escalate their privileges to access all others.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch ArcadeDB\u003c/strong\u003e: Immediately upgrade ArcadeDB server instances to version 26.7.2 or later to apply the necessary security fixes.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor Webserver Logs\u003c/strong\u003e: Deploy the Sigma rule in this brief to your SIEM and monitor webserver logs for HTTP requests targeting the vulnerable \u003ccode\u003e/api/v1/batch/\u003c/code\u003e and \u003ccode\u003e/api/v1/ts/\u003c/code\u003e API endpoints.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Access Logs\u003c/strong\u003e: Periodically review webserver access logs for anomalous requests to the \u003ccode\u003e/api/v1/batch/{db}\u003c/code\u003e and \u003ccode\u003e/api/v1/ts/{db}/*\u003c/code\u003e paths, particularly for requests to database names that the originating user should not have access to.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-16T20:21:14Z","date_published":"2026-07-16T20:21:14Z","id":"https://feed.craftedsignal.io/briefs/2026-07-arcadedb-idor/","summary":"ArcadeDB server versions prior to 26.7.2 are vulnerable to a cross-database Insecure Direct Object Reference (IDOR) due to improper authorization checks in several HTTP handlers, enabling a user authorized for a specific database to gain full read and write access to other unauthorized databases by directly accessing specific API endpoints.","title":"ArcadeDB Cross-Database IDOR Vulnerability Allows Unauthorized Data Access","url":"https://feed.craftedsignal.io/briefs/2026-07-arcadedb-idor/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["arcadedb-engine (\u003c 26.7.2)"],"_cs_severities":["high"],"_cs_tags":["ArcadeDB","RCE","vulnerability","java","database","privilege-escalation","SSRF","DoS","javascript","sql-command-injection"],"_cs_type":"advisory","_cs_vendors":["ArcadeDB"],"content_html":"\u003cp\u003eA high-severity vulnerability has been identified in ArcadeDB, affecting versions prior to 26.7.2. The \u003ccode\u003eScriptTriggerExecutor\u003c/code\u003e component, responsible for executing trigger scripts, includes \u003ccode\u003ejava.lang.*\u003c/code\u003e in its allowed packages. This oversight permits an authenticated attacker with \u003ccode\u003eUPDATE_SCHEMA\u003c/code\u003e privileges (a schema administrator) to craft and deploy a malicious JavaScript trigger. When such a trigger fires, it can invoke \u003ccode\u003ejava.lang.Runtime.exec()\u003c/code\u003e, leading to arbitrary operating system command execution on the host server where ArcadeDB is running. This effectively escalates privileges from a database schema administrator to remote code execution on the underlying operating system, posing a significant risk to the integrity and confidentiality of the host system and the data stored within ArcadeDB.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains \u003ccode\u003eUPDATE_SCHEMA\u003c/code\u003e administrative privileges within an ArcadeDB instance.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious database trigger script that includes an OS command execution payload.\u003c/li\u003e\n\u003cli\u003eThe attacker registers this malicious trigger within ArcadeDB using the \u003ccode\u003eCREATE TRIGGER ... EXECUTE JAVASCRIPT\u003c/code\u003e command.\u003c/li\u003e\n\u003cli\u003eThe JavaScript payload within the trigger leverages the permissive \u003ccode\u003ejava.lang.*\u003c/code\u003e allow-list to call \u003ccode\u003eJava.type(\u0026quot;java.lang.Runtime\u0026quot;).getRuntime().exec(...)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe crafted trigger is saved into the database schema, awaiting its activation conditions.\u003c/li\u003e\n\u003cli\u003eA subsequent database operation or event occurs that satisfies the conditions for the newly created malicious trigger to fire.\u003c/li\u003e\n\u003cli\u003eThe ArcadeDB \u003ccode\u003eScriptTriggerExecutor\u003c/code\u003e processes the trigger, and due to \u003ccode\u003ejava.lang.*\u003c/code\u003e being in the allow-list, the \u003ccode\u003ejava.lang.Runtime.exec()\u003c/code\u003e call is permitted.\u003c/li\u003e\n\u003cli\u003eThe attacker's specified operating system commands are executed on the host server with the privileges of the ArcadeDB process, achieving remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in arbitrary remote code execution on the server hosting ArcadeDB. This allows an attacker to completely compromise the underlying operating system, potentially leading to data exfiltration, deletion, or modification of any data accessible by the ArcadeDB process. While it requires an attacker to first obtain \u003ccode\u003eUPDATE_SCHEMA\u003c/code\u003e privileges, the RCE then allows for privilege escalation from a schema administrator role to full system control. The compromise can affect any operating system ArcadeDB is deployed on, including Windows, Linux, and macOS.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ArcadeDB installations immediately to version 26.7.2 or later to apply the official patch.\u003c/li\u003e\n\u003cli\u003eReview and ensure strict access controls are in place for users assigned \u003ccode\u003eUPDATE_SCHEMA\u003c/code\u003e privileges.\u003c/li\u003e\n\u003cli\u003eAdministrators should monitor database logs for suspicious \u003ccode\u003eCREATE TRIGGER\u003c/code\u003e statements that include \u003ccode\u003eJAVASCRIPT\u003c/code\u003e execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-16T20:22:19Z","date_published":"2026-07-16T20:17:00Z","id":"https://feed.craftedsignal.io/briefs/2026-07-arcadedb-rce/","summary":"A vulnerability in ArcadeDB's ScriptTriggerExecutor allows users with UPDATE_SCHEMA privileges to achieve OS Remote Code Execution (RCE) due to a permissive allow-list for trigger scripts, enabling direct calls to `java.lang.Runtime.exec()` when a malicious trigger script is created and fired.","title":"ArcadeDB Trigger Script RCE via Java.lang.* Allow-list","url":"https://feed.craftedsignal.io/briefs/2026-07-arcadedb-rce/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9,"id":"CVE-2026-44221"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["arcadedb-server","ArcadeDB","arcadedb-engine (\u003c 26.6.1)"],"_cs_severities":["critical"],"_cs_tags":["authorization bypass","privilege escalation","cve-2026-44221"],"_cs_type":"advisory","_cs_vendors":["ArcadeData","ArcadeDB"],"content_html":"\u003cp\u003eArcadeDB, a multi-model database, is susceptible to an authorization bypass vulnerability affecting versions prior to 26.4.2. This vulnerability stems from two distinct defects: first, the \u003ccode\u003eServerSecurityUser.getDatabaseUser()\u003c/code\u003e method returns a database user with an uninitialized file access map, which is then incorrectly interpreted as allowing all access. Second, the \u003ccode\u003eArcadeDBServer.createDatabase()\u003c/code\u003e method omits the \u003ccode\u003efactory.setSecurity(...)\u003c/code\u003e call, effectively disabling the record-level authorization system for any database created via the API endpoint \u003ccode\u003ePOST /api/v1/server {\u0026quot;command\u0026quot;:\u0026quot;create database X\u0026quot;}\u003c/code\u003e.  This combination of flaws allows authenticated principals to bypass both record-level and database-level authorization constraints.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker authenticates to the ArcadeDB server with valid credentials for a specific database.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the \u003ccode\u003eServerSecurityUser.getDatabaseUser()\u003c/code\u003e flaw to gain unauthorized access to other databases.\u003c/li\u003e\n\u003cli\u003eThe attacker exploits the uninitialized \u003ccode\u003efileAccessMap\u003c/code\u003e vulnerability, allowing them to bypass file access checks.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a request to read data from a database they should not have access to, such as \u003ccode\u003eGET /api/v1/database/OtherDatabase/query/sql/SELECT%20*%20FROM%20SomeTable\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server incorrectly authorizes the request due to the flawed access control mechanisms.\u003c/li\u003e\n\u003cli\u003eThe attacker then attempts to modify the schema of another database using API calls that would normally be restricted based on database-level permissions. For example, \u003ccode\u003ePOST /api/v1/database/OtherDatabase {\u0026quot;command\u0026quot;:\u0026quot;alter database X\u0026quot;}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf an attacker creates a new database using \u003ccode\u003ePOST /api/v1/server {\u0026quot;command\u0026quot;:\u0026quot;create database X\u0026quot;}\u003c/code\u003e, the record-level authorization system is disabled due to the missing \u003ccode\u003efactory.setSecurity(...)\u003c/code\u003e call.\u003c/li\u003e\n\u003cli\u003eThe attacker then exploits the newly created database, which has no security checks, gaining complete control over its data and schema.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized access to sensitive data stored in other databases within the same ArcadeDB server. An attacker can read, write, and modify data across multiple databases, leading to potential data breaches, data corruption, and complete system compromise. Organizations using affected versions of ArcadeDB are at risk of significant data loss and reputational damage.  The vulnerability affects all deployments using versions prior to 26.4.2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ArcadeDB server to version 26.4.2 to patch CVE-2026-44221 and resolve the authorization bypass vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for unusual API requests targeting multiple databases from a single authenticated user to detect potential exploitation attempts, and deploy the provided Sigma rule \u003ccode\u003eDetect ArcadeDB Database Access from Different IPs\u003c/code\u003e to detect this activity.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on API endpoints to mitigate potential brute-force attacks aimed at exploiting this vulnerability and use \u003ccode\u003eDetect ArcadeDB Unsecured Database Creation\u003c/code\u003e Sigma rule to detect unauthorized database creation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-16T20:10:01Z","date_published":"2026-05-05T22:22:22Z","id":"https://feed.craftedsignal.io/briefs/2026-05-arcadedb-auth-bypass/","summary":"ArcadeDB versions prior to 26.4.2 are vulnerable to an authorization bypass, allowing authenticated users and API tokens scoped to a specific database to read, write, and mutate schema on any other database on the same server, and disabling the record-level authorization system for newly created databases.","title":"ArcadeDB Authorization Bypass Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-arcadedb-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - ArcadeDB","version":"https://jsonfeed.org/version/1.1"}