EUVD-2026-51832
GHSA-mr73-pqgp-rqp5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation needs any authenticated DB role so PR:L not PR:N; the Graal sandbox blocks host access, limiting C/I to SSRF/control-bypass (Low) while unbounded CPU/memory yields A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.
AnalysisAI
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only roles - run sandboxed JavaScript by submitting a SQL 'DEFINE FUNCTION ... LANGUAGE js' statement, defeating a control that was supposed to restrict scripting to security administrators. The prior GHSA-48qw-824m-86pr hardening added a UPDATE_SECURITY permission gate to the polyglot engine, but the SQL route to JavaScript never invokes it, so low-privilege users regain the very capability the gate was meant to remove. Reported by VulnCheck; the vendor advisory publicly documents a complete two-request exploitation recipe, and the vendor scores it CVSS 4.0 9.3 (Critical), though the runtime sandbox meaningfully limits real-world impact.
Technical ContextAI
ArcadeDB is a multi-model (graph, document, key-value, time-series) database written in Java that exposes an HTTP command API and multiple query engines, including a GraalVM-based polyglot engine for JavaScript. The vulnerability is a CWE-863 (Incorrect Authorization) flaw: an earlier fix added checkPermissionsOnDatabase(UPDATE_SECURITY) only to PolyglotQueryEngine.java (lines 112-114,126,176,199), leaving the parallel SQL code path uncovered. DefineFunctionStatement.executeSimple (DefineFunctionStatement.java:37-100), LocalSchema.registerFunctionLibrary, and the SQLQueryEngine library-function invocation (SQLQueryEngine.java:198-224) register and execute 'LANGUAGE js' functions without any scripting-permission check, so the SQL DEFINE FUNCTION grammar becomes an unguarded second entrance to the JS engine. Notably, the Graal Context is not fully locked down: allowedPackages is empty (blocking Java.type host lookups and reflection), but IOAccess.ALL remains set, so JavaScript can still perform load(url) for remote-JS inclusion and SSRF and can consume unbounded CPU/memory.
RemediationAI
Upgrade to ArcadeDB 26.7.2 or later, which is the vendor-released patched version (com.arcadedb:arcadedb-engine 26.7.2); the fix centralizes an assertCanExecuteUserCode(database) check invoked by every code-execution surface (DefineFunctionStatement.executeSimple, the SQLQueryEngine library-function wrapper, and DeleteFunctionStatement) for js/polyglot languages, and hardens the Graal Context with IOAccess.NONE / PolyglotAccess.NONE. Consult the advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vwjc-v7x7-cm6g. If you cannot patch immediately, restrict database accounts to the minimum necessary users and remove or tightly scope any low-privilege/read-only roles that do not require them, since the flaw is reachable by any authenticated DB user; place the HTTP command API (/api/v1/command) behind network controls or a reverse proxy so it is not reachable by untrusted clients; and, at the network layer, egress-filter the database host to block outbound HTTP/URL fetches to mitigate the load(url) SSRF/remote-JS vector - noting this does not stop CPU/memory DoS and will break any legitimate JS functions that fetch remote resources. These are compensating controls only; none fully closes the authorization gap that the 26.7.2 upgrade fixes.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today