CVE-2026-44221 ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases
Authenticated users can bypass authorization to read, write, and modify schema in any database on the same ArcadeDB server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44221?
CVE-2026-44221 is a critical missing authorization vulnerability in ArcadeData arcadedb, published on 12 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.
Weakness: CWE-863
Which versions are affected by CVE-2026-44221?
2 open source packages ship an affected version, including com.arcadedb:arcadedb-server.
| Package | Affected | Fixed in |
|---|---|---|
com.arcadedb:arcadedb-server Maven | From 21.10.1 | 26.4.2 |
com.arcadedb:arcadedb-server Maven | From 21.10.1 | 26.4.2 |
How do I fix CVE-2026-44221?
Upgrade com.arcadedb:arcadedb-server to 26.4.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44221 being exploited?
There is no known exploitation of CVE-2026-44221 in the wild and no public exploit code.
Sources
Also known as GHSA-fxc7-fm93-6q77.