CVE-2026-67356

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.3

Description An issue exists where the LocalDatabase object is bound into JavaScript trigger contexts using HostAccess.ALL. This allows users with UPDATE SCHEMA permissions to bypass permission checks by calling the getSecurity().createUser() function. An attacker can exploit this by creating triggers that execute JavaScript to create server-wide administrator accounts, resulting in privilege escalation.

Recommendations Update ArcadeDB to version 26.7.3 or later.