CVE-2026-44221: ArcadeDB: cross-database authorization bypass (CWE-863)

Overview

ArcadeDB is a multi-model database management system. According to the available record, two separate defects combined to let an authenticated user, or an API token limited to one database, read, write and change the schema of other databases on the same server. The weakness is classified as CWE-863 (Incorrect Authorization).

The first defect concerns how a database-specific user object is initialized for file access checks. The second concerns databases created through the server API, which were reported to be created without their record-level security configured.

Impact

• Principals restricted to a single database can reach other databases on the same server.
• Record-level and database-level authorization can be bypassed by any authenticated principal, according to the record.
• The CVSS 3.1 base score is 9.0 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, which reflects high impact to confidentiality, integrity and availability and a scope change.

Affected products and versions

• Product: ArcadeData Arcadedb.
• Affected range: version 21.10.1 or later and before 26.4.2.
• The record states the vulnerability is fixed in 26.4.2. The fixes field in the record is empty, which only means no structured fix entry was attached; it does not mean no fix exists.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The SSVC fields in the record report exploitation as none and automatable as no. The EPSS probability is 0.00429 with a percentile of 0.35411. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Upgrade ArcadeDB to version 26.4.2 or a later release, as stated in the record.
• Because the defect affected databases created through the server API, review databases created on servers that ran a vulnerable version and verify their access control settings after upgrading.
• Review accounts and API tokens that are scoped to a single database and confirm they cannot read or change other databases.
• The record does not describe workarounds. Any interim measure should be validated by the maintainer's advisory before relying on it.

Detection guidance

• Review authentication and access logs for accounts or tokens limited to one database that show activity against other databases on the same server.
• Compare the schema and data changes across databases for unexpected modifications made by single-database principals.
• Build an inventory of databases created through the server administration interface and check whether their authorization settings match the rest of the environment.

Limitations of the available information

• The record does not include a detailed vendor-authored exploitation analysis or proof-of-concept details, and none are provided here.
• The contents of the referenced commits were not reviewed in this analysis; they are listed as references only.
• The record lacks workaround information and an explicit list of fixed versions beyond 26.4.2.
• The EPSS date in the record (2026-10-13) is taken as given.
• Whether other ArcadeDB branches received backported fixes is unknown from the record.

Frequently asked questions

Which ArcadeDB versions are affected by CVE-2026-44221?

According to the record, versions from 21.10.1 onward and before 26.4.2 are affected.

Is there a fix for CVE-2026-44221?

The record states the vulnerability is fixed in version 26.4.2. Upgrading to that version or later is the primary remediation step.

Is CVE-2026-44221 known to be actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.