CVE-2026-67341
CRITICALArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
Title source: cnaDescription
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-vwjc-v7x7-cm6g)
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vwjc-v7x7-cm6g
Third Party Advisory third-party-advisory
VulnCheck Advisory: ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-sql-define-function
Scores
CVSS v3
9.8
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-863
Status
published
Products (2)
ArcadeData/arcadedb
< 26.7.2
ArcadeData/arcadedb
26.7.2
Published
Aug 01, 2026
Tracked Since
Aug 01, 2026