# CVE-2026-44221: ArcadeData ArcadeDB authorization bypass in arcadedb-server

Source: https://junglewise.ai/threats/cve-2026-44221-arcadedata-arcadedb-authorization-bypass-in-arcadedb-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-44221 · Severity: critical · CVSS 9 · Published 2026-05-12

ArcadeDB is a multi-model database engine. A security flaw allows any user with access to one database to bypass security checks and read, modify, or delete data in any other database on the same server. This could lead to unauthorized access to sensitive information or complete data loss across the entire database environment.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb), [com.arcadedb:arcadedb-server (Maven)](https://junglewise.ai/threats/technologies/com-arcadedb-arcadedb-server). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-44221 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44221 being exploited in the wild.

**How severe is CVE-2026-44221?** Critical severity, with a CVSS score of 9, published 12 May 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB < 26.4.2; ArcadeData Arcadedb-Server < 2.6.4, >= 21.10.1, < 26.4.2; com.arcadedb:arcadedb-server (Maven) < 26.4.2, >= 21.10.1, < 26.4.2, ECOSYSTEM:introduced=21.10.1,fixed=26.4.2.

**Is there a fix for CVE-2026-44221?** Yes. com.arcadedb:arcadedb-server (Maven): upgrade to 26.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44221 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44221?** Check whether you run ArcadeData ArcadeDB, ArcadeData Arcadedb-Server or com.arcadedb:arcadedb-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.arcadedb:arcadedb-server (Maven): upgrade to 26.4.2 or later

  ```sh
  # set com.arcadedb:arcadedb-server to 26.4.2 in your pom.xml or build.gradle
  ```


## Technical details

ArcadeDB contains two defects that lead to an authorization bypass. First, 'ServerSecurityUser.getDatabaseUser()' returns a user object with an uninitialized 'fileAccessMap', which the 'requestAccessOnFile' method incorrectly interprets as granting full access. Second, the 'ArcadeDBServer.createDatabase()' method fails to initialize security settings for databases created via the API, resulting in record-level authorization being disabled by default. An attacker with low-privileged network access can exploit these flaws to perform cross-database CRUD operations and schema mutations. The vulnerability is addressed in version 26.4.2.

## Affected products

- ArcadeData arcadedb-server >= 21.10.1, < 26.4.2

## Identifiers

- CVE-2026-44221
- GHSA-fxc7-fm93-6q77

## Timeline

- 2026-04-27: disclosed: Initial report by sealbenb
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-12: other: NVD publication date

## References

- [https://api.github.com/users/sealbenb](https://api.github.com/users/sealbenb)
- [https://github.com/sealbenb](https://github.com/sealbenb)
- [https://api.github.com/users/sealbenb/gists%7B/gist_id%7D](https://api.github.com/users/sealbenb/gists%7B/gist_id%7D)
- [https://api.github.com/users/sealbenb/repos](https://api.github.com/users/sealbenb/repos)
- [https://avatars.githubusercontent.com/u/127010643?v=4](https://avatars.githubusercontent.com/u/127010643?v=4)
- [https://api.github.com/users/sealbenb/events%7B/privacy%7D](https://api.github.com/users/sealbenb/events%7B/privacy%7D)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)