Scripting authorization bypass in ArcadeDB via SQL DEFINE FUNCTION (CVE-2026-67341)

ArcadeDB fails to enforce scripting authorization checks on the SQL `DEFINE FUNCTION ... LANGUAGE js` statement. Any user authorized for the database, including read-only roles, can submit this statement via the SQL route to execute arbitrary JavaScript, bypassing the control intended to restrict scripting to security administrators. The vulnerable path additionally permits SSRF via `load(url)` and unbounded CPU/memory denial of service due to `IOAccess.ALL` being in effect. Affected versions: - < 26.7.2 We recommend updating to: 26.7.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vwjc-v7x7-cm6g Details: https://vuln.today/cve/CVE-2026-67341