high8.8
CVE-2026-67356
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().c…
Impact
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
Affected products
| Product | Affected versions |
|---|---|
| ArcadeDB | before 26.7.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.