ArcadeDB Critical Vulnerability Bypasses Authorization Across Databases

The National Vulnerability Database has detailed CVE-2026-44221, a critical vulnerability in ArcadeDB Multi-Model DBMS versions prior to 2.6.4. This flaw allows authenticated users or API tokens, even those scoped to a single database, to read, write, and modify schema on any other database hosted on the same server. This isn’t just a misconfiguration; it’s a fundamental breakdown of authorization.

The vulnerability stems from two distinct defects. First, ServerSecurityUser.getDatabaseUser() was returning a database user with an uninitialized fileAccessMap, which requestAccessOnFile incorrectly interpreted as an ‘allow-all’ setting. Second, ArcadeDBServer.createDatabase() failed to properly initialize security settings via factory.setSecurity(...) when creating databases through the API (POST /api/v1/server {"command":"create database X"}). This silently disabled the entire record-level authorization system for newly created databases. Combined, these two issues allow any authenticated principal to completely bypass both record-level and database-level authorization.

This is a severe design flaw, not merely an implementation bug. It means that once an attacker gains any authenticated access to an ArcadeDB instance, they can effectively achieve full control over all databases on that server, regardless of their initial scope. The National Vulnerability Database assigned this a CVSS score of 9 (CRITICAL), highlighting the ease of exploitation (low complexity, low privileges) and the complete compromise of confidentiality, integrity, and availability.