CVE-2026-67356 — ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() withou…
Published: 2026-08-02 · CVSS: 8.7 · CVSS 4.0
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7