CVE-2026-44221: ArcadeData ArcadeDB authorization bypass in arcadedb-server

CVE-2026-44221 · Severity: critical · CVSS 9 · Published 2026-05-12

ArcadeDB is a multi-model database engine. A security flaw allows any user with access to one database to bypass security checks and read, modify, or delete data in any other database on the same server. This could lead to unauthorized access to sensitive information or complete data loss across the entire database environment.

Technologies: ArcadeData ArcadeDB, com.arcadedb:arcadedb-server (Maven). Vendors: ArcadeData, Maven.

Quick answers

Is CVE-2026-44221 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44221 being exploited in the wild.
How severe is CVE-2026-44221?
Critical severity, with a CVSS score of 9, published 12 May 2026.
Which products and versions are affected?
ArcadeData ArcadeDB < 26.4.2; ArcadeData Arcadedb-Server < 2.6.4, >= 21.10.1, < 26.4.2; com.arcadedb:arcadedb-server (Maven) < 26.4.2, >= 21.10.1, < 26.4.2, ECOSYSTEM:introduced=21.10.1,fixed=26.4.2.
Is there a fix for CVE-2026-44221?
Yes. com.arcadedb:arcadedb-server (Maven): upgrade to 26.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44221 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44221?
Check whether you run ArcadeData ArcadeDB, ArcadeData Arcadedb-Server or com.arcadedb:arcadedb-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.arcadedb:arcadedb-server (Maven): upgrade to 26.4.2 or later
    # set com.arcadedb:arcadedb-server to 26.4.2 in your pom.xml or build.gradle

Technical details

ArcadeDB contains two defects that lead to an authorization bypass. First, 'ServerSecurityUser.getDatabaseUser()' returns a user object with an uninitialized 'fileAccessMap', which the 'requestAccessOnFile' method incorrectly interprets as granting full access. Second, the 'ArcadeDBServer.createDatabase()' method fails to initialize security settings for databases created via the API, resulting in record-level authorization being disabled by default. An attacker with low-privileged network access can exploit these flaws to perform cross-database CRUD operations and schema mutations. The vulnerability is addressed in version 26.4.2.

Affected products

  • ArcadeData arcadedb-server >= 21.10.1, < 26.4.2

Identifiers

  • CVE-2026-44221
  • GHSA-fxc7-fm93-6q77

Timeline

  • 2026-04-27: disclosed: Initial report by sealbenb
  • 2026-05-05: advisory: GitHub Advisory published
  • 2026-05-12: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.