arcadedata/arcadedb Security Advisories | GitStock

high2026-07-16

ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

GHSA-x8mg-6r4p-87pf

high2026-07-16

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

GHSA-vwjc-v7x7-cm6g

high2026-07-16

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

GHSA-x9f9-r4m8-9xc2

high2026-07-16

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

GHSA-48qw-824m-86pr

high2026-07-16

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

GHSA-vg6x-6pg9-6qwg · CVE-2026-54076

high2026-07-16

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

GHSA-8w86-m9h8-hvqg · CVE-2026-54077

critical2026-05-05

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

GHSA-fxc7-fm93-6q77 · CVE-2026-44221