Privilege Escalation Vulnerability in ArcadeDB by ArcadeData

CVE-2026-67356

What is CVE-2026-67356?

ArcadeDB versions prior to 26.7.3 contain a vulnerability that exposes the LocalDatabase object to JavaScript trigger contexts with excessive permissions. This flaw permits schema-admins to invoke getSecurity().createUser() without undergoing crucial permission checks. As a result, malicious actors who possess UPDATE_SCHEMA privileges can establish triggers that execute custom JavaScript, which in turn can create server-wide admin users, ultimately leading to unauthorized access and privilege escalation.

References