Com.arcadedb vulnerabilities
We track 3 vulnerabilities in Com.arcadedb products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest Com.arcadedb vulnerabilities
- 7.7 High severity
arcadedb: Improper Privilege Management
ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database
- 7.1 High severity
arcadedb: Improper Limitation of a Pathname to a Restricted Directory
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/a
- 8.1 High severity
arcadedb: Missing Authorization
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumen