{"id":"CVE-2026-44221","summary":"ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases","details":"ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {\"command\":\"create database X\"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.","aliases":["GHSA-fxc7-fm93-6q77"],"modified":"2026-08-12T16:24:29.129270Z","published":"2026-05-12T19:53:39.307Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44221.json"},"references":[{"type":"ADVISORY","url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-fxc7-fm93-6q77"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44221.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44221"},{"type":"FIX","url":"https://github.com/ArcadeData/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8"},{"type":"FIX","url":"https://github.com/ArcadeData/arcadedb/commit/9e708f116b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/arcadedata/arcadedb","events":[{"introduced":"bf7080e0f2e6b6784a17193c03dea2a662a8063d"},{"fixed":"04110c06315da55604ac107f71fe7182f3a3deb8"},{"fixed":"9e708f116b"}],"database_specific":{"extracted_events":[{"introduced":"21.10.1"},{"fixed":"26.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["26.3.2","26.3.1","26.2.1","26.1.1","25.12.1","25.11.1","25.10.1","25.9.1","25.8.1","25.7.1","25.6.1","25.4.1","25.3.2","25.3.1","25.2.1","25.1.1","24.11.2","24.11.1","24.10.1","24.6.1","24.5.1","24.4.1","24.2.1","24.1.1","23.12.2","23.12.1","23.11.1","23.10.1","23.9.1","23.7.1","23.6.1","23.5.1","23.4.1","23.3.1","23.2.1","23.1.2","23.1.1","22.12.1","22.11.1","22.10.1","22.9.1","22.8.1","22.6.1","22.2.1","22.1.3","22.1.2","21.12.1","21.11.1","21.10.2","21.10.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44221.json","vanir_signatures_modified":"2026-08-12T16:24:29Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["196403731090996756698819832973191600211","288187748702919502298611264404662321527","53361799537177615710326442706828501264","235674478627145610917944624705638630628","20833599200448434381667194663903652411","36661798572376615578656373791551938363","134723787113868689164807399181045379426","321096703820569911189907602497436339767","221225822035875589052831157022384407158"],"threshold":0.9},"id":"CVE-2026-44221-3ded763c","signature_type":"Line","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java"}},{"id":"CVE-2026-44221-59c0a08c","signature_type":"Line","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"server/src/test/java/com/arcadedb/server/security/CrossDatabaseAccessIT.java"},"deprecated":false,"digest":{"line_hashes":["230344429068811301568411935303419277472","63061314645230032683842927130498749806","68188923901810929607211446051513349897","27495164444972521540168231740816895057","256284677898192235708514825980213855948","220728478931895524136126049439993860821","211738174656659734374727450843722328037","260566356864218920767064863526562922828","211429954607795449517441752688367450754","22879384904228457783577819261979546667","74973854970781594262216896876240168675"],"threshold":0.9}},{"id":"CVE-2026-44221-63bb9008","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"createProperty"},"deprecated":false,"digest":{"function_hash":"289497144239561896615075748111755177216","length":615}},{"signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"server/src/main/java/com/arcadedb/server/security/ServerSecurity.java","function":"getDatabaseGroupsConfiguration"},"deprecated":false,"digest":{"function_hash":"22910030154130930530951937784434918011","length":394},"id":"CVE-2026-44221-6e6b9940","signature_type":"Function"},{"digest":{"function_hash":"95750830173832942225706208903293245402","length":985},"id":"CVE-2026-44221-afb2de1d","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"server/src/test/java/com/arcadedb/server/security/CrossDatabaseAccessIT.java","function":"createToken"},"deprecated":false},{"digest":{"line_hashes":["180462820031790772772089877945392423703","159177740263817368716718253404710467884","64018968295220516008297862416633451612","284466947053971006954606808941637711199","314183285756045540985869212682626256913","169502322582343266592263365328312826600","340050824025517329383993493830742215570","329126408962324292976327219725207115998"],"threshold":0.9},"id":"CVE-2026-44221-bccdc243","signature_type":"Line","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"server/src/main/java/com/arcadedb/server/security/ServerSecurity.java"},"deprecated":false},{"digest":{"function_hash":"174116071749906676761343485189397119112","length":816},"id":"CVE-2026-44221-d4835956","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"server/src/main/java/com/arcadedb/server/ArcadeDBServer.java","function":"createDatabase"},"deprecated":false},{"id":"CVE-2026-44221-ff865e6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","target":{"file":"server/src/main/java/com/arcadedb/server/ArcadeDBServer.java"},"deprecated":false,"digest":{"line_hashes":["234720985032918714136864726443355038477","315746088056881301192788112593014513820","132317531322007116494656633967748167424"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}