CVE-2026-75854

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 enforces per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query paths reaching data through LSM index files or the TimeSeries engine never invoke that check, so an authenticated user denied readRecord/deleteRecord can still read indexed key values, record IDs, MAX/MIN values, TimeSeries samples, learn record counts, and delete index entries, desynchronizing the index from data. Index and type names are discoverable via SELECT FROM schema:indexes. Affects embedded and server deployments and all transports. Fixed in 26.9.1.

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript command via the /api/v1/command endpoint to run code with unrestricted host access and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

ArcadeDB before version 26.7.2 contains an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Attackers can access and modify databases without proper permissions by directly calling affected endpoints with arbitrary database parameters.

ArcadeDB before version 26.7.2 fails to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

ArcadeDB versions 21.10.1 through 26.4.1 have two defects: (1) ServerSecurityUser.getDatabaseUser() returns a DB user with an uninitialized fileAccessMap, causing allow-all; (2) ArcadeDBServer.createDatabase() omits factory.setSecurity(...), disabling record-level authorization for new databases. An authenticated user or API token can read, write, and mutate schema on any other database on the same server.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, not covering subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with UPDATE_SCHEMA privilege can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke ResourceBundle.getBundle(String) to read .properties resources from the application classpath, disclosing sensitive configuration data. Fixed in 26.9.1.

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.

A vulnerability in ArcadeDB before 26.9.1 allows an authenticated low-privilege user to bypass ACL enforcement on vertex and edge types. This is triggered by sending a batch request to POST /api/v1/batch/{database} with default parallel processing, which fails to bind the user principal to the async worker threads. The user can then append edges to protected vertices, modifying graph data without authorization.