CVE-2026-44221
ArcadeDB Multi‑Model DBMS versions 21.10.1 through 26.4.1 allow an authenticated user or API token scoped to one database to read, write, and change the schema of any other database on the same server. The flaw is caused by an uninitialized file access map and a missing security factory setting. It has been fixed in version 26.4.2.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
ArcadeDB Multi‑Model DBMS versions 21.10.1 to 26.4.1 (prior to 26.4.2).
Real-world impact
An attacker who can authenticate to one database can read, modify, and delete data in any other database on the same server, bypassing all record‑level and database‑level authorization controls, thereby compromising confidentiality, integrity, and availability of all databases.
Why this severity
The CVSS score of 9 reflects that the vulnerability can be exploited over the network with low effort and low privilege, requires user interaction, changes the system scope, and gives an attacker full control over confidentiality, integrity, and availability.
What to do about it
- 01Upgrade ArcadeDB to version 26.4.2 or later.
NVD-referenced vendor advisory
Timeline
- May 12, 2026 · May 12, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Aug 3, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 3, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.