Description
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ArcadeData | arcadedb | < 26.7.3 | 26.7.3 |
References
- GitHub Security Advisory (GHSA-38pf-6hp2-pxww) vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger third-party-advisory