ArcadeDB CVE-2026-67356

Exploitation requires the attacker to hold UPDATE_SCHEMA permission on the target ArcadeDB server, which is the permission that enables creation of JavaScript-based database triggers. The attacker must be able to create and execute a trigger - either by waiting for normal application events to fire it, or by manually invoking a schema operation to trigger it. The vulnerability is rooted in the HostAccess.ALL binding of the LocalDatabase object in the trigger runtime context; this binding is present in all ArcadeDB versions before 26.7.3 by default with no optional configuration required to expose it. Exploitation is strictly limited to authenticated users possessing UPDATE_SCHEMA: unauthenticated users, and authenticated users holding only lower-privilege roles (e.g., read or write), cannot reach the vulnerable code path. In tightly managed deployments where UPDATE_SCHEMA is restricted to a small number of trusted administrators, the practical attack surface is narrow.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the severity: network-accessible exploitation with low complexity, requiring only low-privilege (UPDATE_SCHEMA) credentials. The High confidentiality, integrity, and availability impacts are consistent with full server compromise following admin account creation. The critical limiting factor is the prerequisite of UPDATE_SCHEMA permission, which elevates the effective attack complexity in practice - this is not exploitable by unauthenticated users or ordinary read/write database users. In multi-tenant or delegated-admin deployments, however, UPDATE_SCHEMA grants may be distributed broadly, substantially expanding the realistic attacker pool. EPSS data was not provided in the intelligence; no KEV listing confirms active exploitation. The absence of confirmed POC code means this is a disclosed-but-not-yet-weaponized issue as of analysis time, making prompt patching feasible before exploitation becomes opportunistic.

An attacker with UPDATE_SCHEMA permission connects to a vulnerable ArcadeDB instance and creates a JavaScript trigger on any schema object. When the trigger fires - either triggered by the attacker themselves or by normal application activity - the JavaScript code calls getSecurity().createUser() through the exposed LocalDatabase reference, silently creating a new server-wide administrator account. The attacker then authenticates as the newly created admin, achieving full control over all databases, users, and server configuration far beyond their originally scoped UPDATE_SCHEMA authorization.