CVE-2026-67341

CRITICAL

ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

Title source: cna
STIX 2.1

Description

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-vwjc-v7x7-cm6g)
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vwjc-v7x7-cm6g
Third Party Advisory third-party-advisory
VulnCheck Advisory: ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-sql-define-function

Scores

CVSS v3 9.8
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-863
Status published
Products (2)
ArcadeData/arcadedb < 26.7.2
ArcadeData/arcadedb 26.7.2
Published Aug 01, 2026
Tracked Since Aug 01, 2026