ArcadeDB - CraftedSignal Threat Feed

ArcadeDB Cross-Database IDOR Vulnerability Allows Unauthorized Data Access

hello@craftedsignal.io — Thu, 16 Jul 2026 20:21:14 +0000

ArcadeDB, an open-source NoSQL graph database, contains a critical Insecure Direct Object Reference (IDOR) vulnerability (GHSA-x8mg-6r4p-87pf) affecting server versions prior to 26.7.2. This flaw allows a user with valid credentials, who is authorized to access only one database, to bypass authorization checks and gain full read and write access to other, unauthorized databases within the same ArcadeDB instance. The vulnerability stems from 14 specific HTTP handlers (including those for batch operations, time-series data, Prometheus, and Grafana integrations) which directly extend AbstractServerHttpHandler instead of the secure DatabaseAbstractHandler, failing to invoke the crucial user.canAccessToDatabase() function. Exploitation of this vulnerability grants attackers unauthorized control over sensitive data across different databases, posing a significant risk of data exfiltration, manipulation, or integrity compromise. This issue directly impacts organizations using ArcadeDB for multi-tenant or segmented data storage.

Attack Chain

Initial Authentication: An attacker obtains valid user credentials for an ArcadeDB instance, successfully authenticating and gaining authorized access to at least one specific database (e.g., 'DB A').
Identify Vulnerable Endpoints: The attacker identifies specific ArcadeDB HTTP API endpoints, such as /api/v1/batch/{db}, /api/v1/ts/{db}/write, or /api/v1/ts/{db}/prom/api/v1/query, which are known to be affected by the IDOR vulnerability.
Craft Malicious HTTP Request: The attacker crafts an HTTP request (GET or POST) targeting one of the identified vulnerable endpoints. Crucially, the attacker substitutes the database identifier in the URL path parameter (e.g., {db}) from their authorized database ('DB A') to an unauthorized target database ('DB B').
Authorization Bypass: Upon receiving the request, the ArcadeDB server's vulnerable HTTP handler (e.g., PostBatchHandler or PostTimeSeriesWriteHandler) processes the {database} path parameter without invoking the necessary user.canAccessToDatabase() authorization check.
Unauthorized Database Access: The server proceeds to resolve and access the target database ('DB B') despite the attacker's lack of explicit authorization for it.
Perform Unauthorized Operations: The attacker successfully executes read (e.g., via /api/v1/ts/b/prom/api/v1/query) or write (e.g., via /api/v1/batch/b or /api/v1/ts/b/write) operations on the unauthorized 'DB B', receiving a "200 OK" HTTP status code.
Data Exfiltration or Manipulation: Through these unauthorized operations, the attacker gains full control over 'DB B', allowing for data exfiltration, modification, or deletion, leading to compromise of data confidentiality and integrity.

Impact

Successful exploitation of this IDOR vulnerability allows an authenticated attacker to bypass authorization controls, gaining complete read and write access to any database within the ArcadeDB instance, regardless of their assigned permissions. This leads to a severe compromise of data confidentiality and integrity across all databases. Attackers can exfiltrate sensitive information, alter critical data, or even delete entire database contents. Organizations utilizing ArcadeDB for multi-tenant environments or to segregate data by user/department are particularly at risk, as an attacker with low-privilege access to one database could escalate their privileges to access all others.

Recommendation

Patch ArcadeDB: Immediately upgrade ArcadeDB server instances to version 26.7.2 or later to apply the necessary security fixes.
Monitor Webserver Logs: Deploy the Sigma rule in this brief to your SIEM and monitor webserver logs for HTTP requests targeting the vulnerable /api/v1/batch/ and /api/v1/ts/ API endpoints.
Review Access Logs: Periodically review webserver access logs for anomalous requests to the /api/v1/batch/{db} and /api/v1/ts/{db}/* paths, particularly for requests to database names that the originating user should not have access to.

ArcadeDB Trigger Script RCE via Java.lang.* Allow-list

hello@craftedsignal.io — Thu, 16 Jul 2026 20:17:00 +0000

A high-severity vulnerability has been identified in ArcadeDB, affecting versions prior to 26.7.2. The ScriptTriggerExecutor component, responsible for executing trigger scripts, includes java.lang.* in its allowed packages. This oversight permits an authenticated attacker with UPDATE_SCHEMA privileges (a schema administrator) to craft and deploy a malicious JavaScript trigger. When such a trigger fires, it can invoke java.lang.Runtime.exec(), leading to arbitrary operating system command execution on the host server where ArcadeDB is running. This effectively escalates privileges from a database schema administrator to remote code execution on the underlying operating system, posing a significant risk to the integrity and confidentiality of the host system and the data stored within ArcadeDB.

Attack Chain

An attacker gains UPDATE_SCHEMA administrative privileges within an ArcadeDB instance.
The attacker crafts a malicious database trigger script that includes an OS command execution payload.
The attacker registers this malicious trigger within ArcadeDB using the CREATE TRIGGER ... EXECUTE JAVASCRIPT command.
The JavaScript payload within the trigger leverages the permissive java.lang.* allow-list to call Java.type("java.lang.Runtime").getRuntime().exec(...).
The crafted trigger is saved into the database schema, awaiting its activation conditions.
A subsequent database operation or event occurs that satisfies the conditions for the newly created malicious trigger to fire.
The ArcadeDB ScriptTriggerExecutor processes the trigger, and due to java.lang.* being in the allow-list, the java.lang.Runtime.exec() call is permitted.
The attacker's specified operating system commands are executed on the host server with the privileges of the ArcadeDB process, achieving remote code execution.

Impact

Successful exploitation of this vulnerability results in arbitrary remote code execution on the server hosting ArcadeDB. This allows an attacker to completely compromise the underlying operating system, potentially leading to data exfiltration, deletion, or modification of any data accessible by the ArcadeDB process. While it requires an attacker to first obtain UPDATE_SCHEMA privileges, the RCE then allows for privilege escalation from a schema administrator role to full system control. The compromise can affect any operating system ArcadeDB is deployed on, including Windows, Linux, and macOS.

Recommendation

Upgrade ArcadeDB installations immediately to version 26.7.2 or later to apply the official patch.
Review and ensure strict access controls are in place for users assigned UPDATE_SCHEMA privileges.
Administrators should monitor database logs for suspicious CREATE TRIGGER statements that include JAVASCRIPT execution.

ArcadeDB Authorization Bypass Vulnerability

hello@craftedsignal.io — Tue, 05 May 2026 22:22:22 +0000

ArcadeDB, a multi-model database, is susceptible to an authorization bypass vulnerability affecting versions prior to 26.4.2. This vulnerability stems from two distinct defects: first, the ServerSecurityUser.getDatabaseUser() method returns a database user with an uninitialized file access map, which is then incorrectly interpreted as allowing all access. Second, the ArcadeDBServer.createDatabase() method omits the factory.setSecurity(...) call, effectively disabling the record-level authorization system for any database created via the API endpoint POST /api/v1/server {"command":"create database X"}. This combination of flaws allows authenticated principals to bypass both record-level and database-level authorization constraints.

Attack Chain

An attacker authenticates to the ArcadeDB server with valid credentials for a specific database.
The attacker leverages the ServerSecurityUser.getDatabaseUser() flaw to gain unauthorized access to other databases.
The attacker exploits the uninitialized fileAccessMap vulnerability, allowing them to bypass file access checks.
The attacker crafts a request to read data from a database they should not have access to, such as GET /api/v1/database/OtherDatabase/query/sql/SELECT%20*%20FROM%20SomeTable.
The server incorrectly authorizes the request due to the flawed access control mechanisms.
The attacker then attempts to modify the schema of another database using API calls that would normally be restricted based on database-level permissions. For example, POST /api/v1/database/OtherDatabase {"command":"alter database X"}.
If an attacker creates a new database using POST /api/v1/server {"command":"create database X"}, the record-level authorization system is disabled due to the missing factory.setSecurity(...) call.
The attacker then exploits the newly created database, which has no security checks, gaining complete control over its data and schema.

Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive data stored in other databases within the same ArcadeDB server. An attacker can read, write, and modify data across multiple databases, leading to potential data breaches, data corruption, and complete system compromise. Organizations using affected versions of ArcadeDB are at risk of significant data loss and reputational damage. The vulnerability affects all deployments using versions prior to 26.4.2.

Recommendation

Upgrade ArcadeDB server to version 26.4.2 to patch CVE-2026-44221 and resolve the authorization bypass vulnerability.
Monitor web server logs for unusual API requests targeting multiple databases from a single authenticated user to detect potential exploitation attempts, and deploy the provided Sigma rule Detect ArcadeDB Database Access from Different IPs to detect this activity.
Implement rate limiting on API endpoints to mitigate potential brute-force attacks aimed at exploiting this vulnerability and use Detect ArcadeDB Unsecured Database Creation Sigma rule to detect unauthorized database creation.