Read the docs
TI-2026-32200 Aliases CVE-2026-44221GHSA-fxc7-fm93-6q77

ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases

Priority MEDIUM 41CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed arcadedb (ArcadeData): 26.4.2com.arcadedb:arcadedb-server (Maven): 26.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArcadeDataarcadedb21.10.1 to before 26.4.226.4.2Patch availableCNA
—com.arcadedb:arcadedb-server (Maven)21.10.1 to before 26.4.226.4.2Patch availableGHSA-fxc7-fm93-6q77
  • arcadedb VendorArcadeData Affected 21.10.1 to before 26.4.2 Fixed in 26.4.2 Patch available CNA
  • com.arcadedb:arcadedb-server (Maven) Vendor— Affected 21.10.1 to before 26.4.2 Fixed in 26.4.2 Patch available GHSA-fxc7-fm93-6q77

Remediation

  • Fix · CNA arcadedb (ArcadeData) Fixed in 26.4.2
  • Fix · GHSA-fxc7-fm93-6q77 com.arcadedb:arcadedb-server (Maven) Fixed in 26.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44221
  2. 2026-10-03 Alias added: GHSA-fxc7-fm93-6q77

References

Advisory 1

Other 4

  • TI-2026-53098 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication CVSS 4.0CRITICAL 9.3
  • TI-2026-53086 ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex CVSS 4.0HIGH 8.7
  • TI-2026-53095 ArcadeDB before 26.8.1 Authentication Bypass via Async Command CVSS 4.0CRITICAL 9.4
  • TI-2026-53089 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction CVSS 4.0CRITICAL 9.4
  • TI-2026-53097 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database CVSS 4.0HIGH 8.7
  • TI-2026-63057 ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission CVSS 4.0HIGH 8.6
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences