Skip to content
OpenAdvisories

Package · Maven

com.arcadedb:arcadedb-server

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.7
    CVE-2026-65831

    ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

    ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce databas…

    ArcadeData com.arcadedb arcadedb arcadedb-server Maven
  • Critical 9.8
    CVE-2026-67342

    ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

    ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not …

    ArcadeData arcadedb com.arcadedb:arcadedb-server Maven
  • Critical 9.0
    CVE-2026-44221

    ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases

    ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contr…

    ArcadeData arcadedb com.arcadedb:arcadedb-server Maven