ArcadeDB allowed authenticated users and database‑scoped API tokens to read, write, and modify schema on any other database on the same server before version 2.6.4. The vulnerability arises from two code defects: an uninitialized fileAccessMap that was treated as allow‑all and a missing security factory call when creating new databases via the API, which disabled record‑level authorization. As a result, any authenticated principal could bypass both record‑level and database‑level controls, and any newly created database would be unsecured by default.

The issue affects ArcadeData ArcadeDB releases earlier than 2.6.4. The fix is included in version 2.6.4 and later.

With a CVSS score of 9, the vulnerability is considered Critical. Attack requires valid authentication but a legitimate credential gives the attacker unrestricted access to all databases on the server, enabling data exfiltration, tampering, or destruction. The EPSS score is not available and the vulnerability is not currently listed in CISA KEV, but the high severity and wide impact warrant immediate remediation. Exploitation is straightforward via the documented API endpoints, and any new database created during the vulnerability period remains unsecured until patched.