CVE-2026-67356 ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger
Attackers with schema-admin permissions can escalate privileges to server-wide admin by creating JavaScript triggers that bypass security checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67356?
CVE-2026-67356 is a high-severity vulnerability in ArcadeData arcadedb, published on 2 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
Weakness: CWE-269
Which versions are affected by CVE-2026-67356?
How do I fix CVE-2026-67356?
No fix has been published for CVE-2026-67356 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-67356 being exploited?
There is no known exploitation of CVE-2026-67356 in the wild and no public exploit code.
Sources
Also known as GHSA-38pf-6hp2-pxww, GHSA-p28w-g8xf-vm54.