Executive brief
ArcadeDB is a database system that allows administrators to create JavaScript triggers to automate actions on data changes. A vulnerability allows schema administrators (who have limited permissions) to create malicious triggers that execute JavaScript code with unrestricted access to internal database objects, enabling them to create server-wide admin accounts and escalate their privileges beyond their intended authorization level.
Technical details
The vulnerability exists in ScriptTriggerExecutor, which binds the real LocalDatabase object into a GraalVM JavaScript execution context with HostAccess.ALL permissions. This allows JavaScript code in triggers to call any public method on the bound database object, including getSecurity().createUser(). The ServerSecurity.createUser() method lacks internal permission checks and grants admin privileges on all databases. An attacker with UPDATE_SCHEMA permission (which only controls trigger creation, not user management) can craft a trigger whose JavaScript calls database.getSecurity().createUser() to mint a server-wide admin account, crossing a privilege boundary that is strictly less than UPDATE_SECURITY. The attack requires network access and attacker control of trigger creation, but no user interaction.
Affected products
- ArcadeData ArcadeDB before 26.7.3
Timeline
- 2026-07-17: disclosed
- 2026-07-17: patched: Version 26.7.3 released