ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.

The issue affects ArcadeData ArcadeDB releases earlier than 26.4.2, specifically versions 21.10.1 through 26.4.2. The fix is included in 26.4.2 and later.

With a CVSS score of 9, the vulnerability is considered Critical. Attack requires valid authentication; a legitimate credential gives the attacker unrestricted access to all databases on the server, enabling data exfiltration, tampering, or destruction. The EPSS score is < 1% and the vulnerability is not currently listed in CISA KEV, but the high severity and wide impact warrant immediate remediation. Exploitation is straightforward via the documented API endpoints, and any database created during the vulnerability period remains unsecured until patched.