EUVD-2026-51832
GHSA-mr73-pqgp-rqp5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any DB-authorized role
-
DeliveryPOST DEFINE FUNCTION ... LANGUAGE js to /api/v1/command
-
ExploitBypass UPDATE_SECURITY scripting gate
-
ExecutionSELECT the function to run sandboxed JS
-
Impactload(url) for SSRF/remote-JS or loop for DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated ArcadeDB account with access to the target database - any authorization level suffices, explicitly including read-only roles - plus network reachability to the HTTP command API endpoint /api/v1/command/<db>. The specific trigger is a SQL 'DEFINE FUNCTION <name> "<js>" LANGUAGE js' statement followed by invocation of that function; no admin/security privileges and no user interaction are needed. Limiting factors: it is NOT unauthenticated (the CVSS PR:N is contradicted by the advisory, which requires DB access), and the runtime sandbox constrains outcomes - allowedPackages is empty, so Java.type host access and reflection are blocked, capping impact at load(url)-based SSRF/remote-JS inclusion and CPU/memory DoS rather than direct host command execution. |
| Impact | Signals are strong on exploitability but the raw 9.3 overstates technical impact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) implies unauthenticated network RCE with full CIA loss, but this conflicts with the authoritative advisory text: the description and GHSA both state exploitation requires a user 'authorized for the DB,' so PR:N is inaccurate - realistically PR:L. The VC:H/VI:H/VA:H rating also assumes unrestricted code execution, whereas the source-code evidence shows the sandbox blocks Java.type and reflection, reducing the practical impact to SSRF/remote-JS inclusion (confidentiality/integrity) and DoS (availability High). No CISA KEV entry and no EPSS score were provided, so widespread automated exploitation is not evidenced; however, the advisory publishes an exact, trivially reproducible request sequence, so opportunistic use against reachable instances is plausible. Net: a genuine priority for anyone exposing ArcadeDB to semi-trusted users, but the threat is authenticated privilege-escalation-to-sandboxed-code rather than the pre-auth full RCE the headline score suggests. Verify the PR discrepancy with the vendor before treating it as unauthenticated. |
| Exploit ScenarioDerived | An attacker with any valid ArcadeDB database credential - even a read-only role granted for reporting - sends POST /api/v1/command/<db> with {"language":"sql","command":"DEFINE FUNCTION x.run \"<js>\" LANGUAGE js"}, then invokes it via SELECT x.run(), executing attacker-controlled JavaScript that the platform intended to allow only for security admins. Using the still-permitted IOAccess.ALL, the JS calls load(url) to pull in remote script or reach internal-only endpoints (SSRF) and can spin unbounded loops or allocations to exhaust CPU/memory. The vendor advisory documents this exact request sequence, so no novel research is needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 01, 2026
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only roles - run sandboxed JavaScript by submitting a SQL 'DEFINE FUNCTION ... LANGUAGE js' statement, defeating a control that was supposed to restrict scripting to security administrators. The prior GHSA-48qw-824m-86pr hardening added a UPDATE_SECURITY permission gate to the polyglot engine, but the SQL route to JavaScript never invokes it, so low-privilege users regain the very capability the gate was meant to remove. Reported by VulnCheck; the vendor advisory publicly documents a complete two-request exploitation recipe, and the vendor scores it CVSS 4.0 9.3 (Critical), though the runtime sandbox meaningfully limits real-world impact.
RemediationAI
Upgrade to ArcadeDB 26.7.2 or later, which is the vendor-released patched version (com.arcadedb:arcadedb-engine 26.7.2); the fix centralizes an assertCanExecuteUserCode(database) check invoked by every code-execution surface (DefineFunctionStatement.executeSimple, the SQLQueryEngine library-function wrapper, and DeleteFunctionStatement) for js/polyglot languages, and hardens the Graal Context with IOAccess.NONE / PolyglotAccess.NONE. Consult the advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vwjc-v7x7-cm6g. If you cannot patch immediately, restrict database accounts to the minimum necessary users and remove or tightly scope any low-privilege/read-only roles that do not require them, since the flaw is reachable by any authenticated DB user; place the HTTP command API (/api/v1/command) behind network controls or a reverse proxy so it is not reachable by untrusted clients; and, at the network layer, egress-filter the database host to block outbound HTTP/URL fetches to mitigate the load(url) SSRF/remote-JS vector - noting this does not stop CPU/memory DoS and will break any legitimate JS functions that fetch remote resources. These are compensating controls only; none fully closes the authorization gap that the 26.7.2 upgrade fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ArcadeDB is a multi-model (graph, document, key-value, time-series) database written in Java that exposes an HTTP command API and multiple query engines, including a GraalVM-based polyglot engine for JavaScript. The vulnerability is a CWE-863 (Incorrect Authorization) flaw: an earlier fix added checkPermissionsOnDatabase(UPDATE_SECURITY) only to PolyglotQueryEngine.java (lines 112-114,126,176,199), leaving the parallel SQL code path uncovered. DefineFunctionStatement.executeSimple (DefineFunctionStatement.java:37-100), LocalSchema.registerFunctionLibrary, and the SQLQueryEngine library-function invocation (SQLQueryEngine.java:198-224) register and execute 'LANGUAGE js' functions without any scripting-permission check, so the SQL DEFINE FUNCTION grammar becomes an unguarded second entrance to the JS engine. Notably, the Graal Context is not fully locked down: allowedPackages is empty (blocking Java.type host lookups and reflection), but IOAccess.ALL remains set, so JavaScript can still perform load(url) for remote-JS inclusion and SSRF and can consume unbounded CPU/memory.
Know when Arcadedb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploitation needs any authenticated DB role so PR:L not PR:N; the Graal sandbox blocks host access, limiting C/I to SSRF/control-bypass (Low) while unbounded CPU/memory yields A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.
Blast Radius
ecosystem impact- 18 maven packages depend on com.arcadedb:arcadedb-engine (9 direct, 9 indirect)
Ecosystem-wide dependent count for version 26.7.2.
Executive ViewAI
ArcadeDB versions before 26.7.2 contain a critical authorization bypass allowing any authenticated user to execute JavaScript functions, escalating privileges beyond intended read-only restrictions. Publicly available exploit code exists, as documented in vendor advisories. This vulnerability enables privilege escalation in multi-user database environments and could allow unauthorized data manipulation or theft.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before
Exploit-DB