Database Access Flaw in ArcadeDB by ArcadeData

CVE-2026-44221

What is CVE-2026-44221?

ArcadeDB, a multi-model database management system, was found to have significant access control vulnerabilities prior to version 2.6.4. Authenticated users and specific API tokens had the ability to read, write, and mutate schemas across all databases on the server. This security risk arose from two main issues: first, a misconfigured file access map allowed unrestricted access to databases; second, the process of creating a new database omitted necessary security settings, leading to compromised record-level authorization. As a result, any authenticated user could bypass both record-level and database-level security, posing a major threat to data integrity and security within the system.

References