CVE-2026-54076

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 enforces per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query paths reaching data through LSM index files or the TimeSeries engine never invoke that check, so an authenticated user denied readRecord/deleteRecord can still read indexed key values, record IDs, MAX/MIN values, TimeSeries samples, learn record counts, and delete index entries, desynchronizing the index from data. Index and type names are discoverable via SELECT FROM schema:indexes. Affects embedded and server deployments and all transports. Fixed in 26.9.1.

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database without credentials.

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript command via the /api/v1/command endpoint to run code with unrestricted host access and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

ArcadeDB before version 26.7.2 contains an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Attackers can access and modify databases without proper permissions by directly calling affected endpoints with arbitrary database parameters.

ArcadeDB before version 26.7.2 fails to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

ArcadeDB versions 21.10.1 through 26.4.1 have two defects: (1) ServerSecurityUser.getDatabaseUser() returns a DB user with an uninitialized fileAccessMap, causing allow-all; (2) ArcadeDBServer.createDatabase() omits factory.setSecurity(...), disabling record-level authorization for new databases. An authenticated user or API token can read, write, and mutate schema on any other database on the same server.