ArcadeDB versions prior to 26.7.2 inadequately enforce authorization checks for the SQL DEFINE FUNCTION command that creates JavaScript functions. The missing check allows any user with database access to submit arbitrary JavaScript code to the server. As a result, an attacker can run arbitrary code on the database node, leading to full compromise of the database system, including data theft, modification, or denial of service. This is a classic privilege escalation and code execution flaw (CWE-863).

ArcadeData ArcadeDB versions earlier than 26.7.2 are affected. Any installation that has not been upgraded to 26.7.2 or later is vulnerable.

The CVSS score of 9.3 indicates critical severity. EPSS is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, but the high severity warrants immediate attention. Attackers need only database user credentials; they can issue the vulnerable DEFINE FUNCTION statement and execute arbitrary JavaScript. Thus, the attack path is straightforward for anyone with database access, making the risk substantial.