Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-67341

ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.7.2affected
  • 26.7.2unaffected
pkg:maven/com.arcadedb/arcadedb-engine

References