CVE-2026-44221
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
ArcadeDB versions 21.10.1 through 26.4.1 have two defects: (1) ServerSecurityUser.getDatabaseUser() returns a DB user with an uninitialized fileAccessMap, causing allow-all; (2) ArcadeDBServer.createDatabase() omits factory.setSecurity(...), disabling record-level authorization for new databases. An authenticated user or API token can read, write, and mutate schema on any other database on the same server.
Risk Assessment
An attacker with access to one database can gain unauthorized access to all other databases on the server, leading to data leakage and integrity compromise.
Recommendation
Upgrade ArcadeDB to version 26.4.2 or later immediately.
Original NVD description (English source)
ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.