CVE-2026-67341CWE-863broken-access-control

CVE-2026-67341

Critical · published August 1, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00543 · 44.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-01T17:17Z
References (2)
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vwjc-v7x7-cm6g · [email protected]https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-sql-define-function · [email protected]
EPSS history
Timeline
  • 01 AUG 12:22Z
    ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
    cvelistv5