# CVE-2026-67356: ArcadeDB JavaScript trigger privilege escalation

Source: https://junglewise.ai/threats/cve-2026-67356-arcadedb-javascript-trigger-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67356 · Severity: high · CVSS 8.8 · Published 2026-08-02

ArcadeDB is a database system that allows administrators to create JavaScript triggers to automate actions on data changes. A vulnerability allows schema administrators (who have limited permissions) to create malicious triggers that execute JavaScript code with unrestricted access to internal database objects, enabling them to create server-wide admin accounts and escalate their privileges beyond their intended authorization level.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-67356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67356 being exploited in the wild.

**How severe is CVE-2026-67356?** High severity, with a CVSS score of 8.8, published 2 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB before 26.7.3.

**Is there a fix for CVE-2026-67356?** A patch was published on 2026-07-17: Version 26.7.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67356 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67356?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in ScriptTriggerExecutor, which binds the real LocalDatabase object into a GraalVM JavaScript execution context with HostAccess.ALL permissions. This allows JavaScript code in triggers to call any public method on the bound database object, including getSecurity().createUser(). The ServerSecurity.createUser() method lacks internal permission checks and grants admin privileges on all databases. An attacker with UPDATE_SCHEMA permission (which only controls trigger creation, not user management) can craft a trigger whose JavaScript calls database.getSecurity().createUser() to mint a server-wide admin account, crossing a privilege boundary that is strictly less than UPDATE_SECURITY. The attack requires network access and attacker control of trigger creation, but no user interaction.

## Affected products

- ArcadeData ArcadeDB before 26.7.3

## Timeline

- 2026-07-17: disclosed
- 2026-07-17: patched: Version 26.7.3 released

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-38pf-6hp2-pxww](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-38pf-6hp2-pxww)
- [https://www.vulncheck.com/advisories/arcadedb-before-privilege-escalation-via-javascript-trigger](https://www.vulncheck.com/advisories/arcadedb-before-privilege-escalation-via-javascript-trigger)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)