CVE-2026-67341
Received Received - Intake

Scripting Authorization Bypass in ArcadeDB via DEFINE FUNCTION

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67341
EUVD
EUVD-2026-51832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB versions before 26.7.2 do not properly check authorization for the SQL DEFINE FUNCTION statement when using JavaScript as the language. This allows attackers with database access to run arbitrary JavaScript code by submitting such statements, bypassing intended security controls that should restrict scripting to administrators only.

Impact Analysis

An attacker could execute malicious JavaScript code on the server, potentially leading to unauthorized data access, data manipulation, or system compromise. This could result in data breaches, loss of sensitive information, or disruption of database services.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements for data protection and privacy such as GDPR or HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches or non-compliance.

Mitigation Strategies

Upgrade ArcadeDB to version 26.7.2 or later to ensure scripting authorization checks are enforced on SQL DEFINE FUNCTION statements with LANGUAGE js.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67341. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart