{"id":"GHSA-fxc7-fm93-6q77","summary":"ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases","details":"### Impact\nAuthenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {\"command\":\"create database X\"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal.\n\n### Patches\nUpgrade to version 26.4.2\n\n### Resources\n\nhttps://github.com/ArcadeData/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8","aliases":["CVE-2026-44221"],"modified":"2026-08-03T20:45:22.162757757Z","published":"2026-05-05T22:22:22Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-05-05T22:22:22Z","nvd_published_at":"2026-05-12T20:16:43Z","cwe_ids":["CWE-863"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-fxc7-fm93-6q77"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44221"},{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8"},{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/commit/9e708f116b"},{"type":"PACKAGE","url":"https://github.com/ArcadeData/arcadedb"}],"affected":[{"package":{"name":"com.arcadedb:arcadedb-server","ecosystem":"Maven","purl":"pkg:maven/com.arcadedb/arcadedb-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.10.1"},{"fixed":"26.4.2"}]}],"versions":["21.10.1","21.10.2","21.11.1","21.12.1","22.1.1","22.1.2","22.1.3","22.10.1","22.11.1","22.12.1","22.2.1","22.8.1","22.9.1","23.1.1","23.1.2","23.10.1","23.11.1","23.12.1","23.12.2","23.2.1","23.3.1","23.4.1","23.5.1","23.6.1","23.7.1","23.9.1","24.1.1","24.10.1","24.11.1","24.11.2","24.2.1","24.4.1","24.5.1","24.6.1","25.1.1","25.10.1","25.11.1","25.12.1","25.2.1","25.3.1","25.3.2","25.4.1","25.5.1","25.6.1","25.7.1","25.8.1","25.9.1","26.1.1","26.2.1","26.2.2","26.3.1","26.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fxc7-fm93-6q77/GHSA-fxc7-fm93-6q77.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}