CVE-2026-44221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44221
Aliases
Published
2026-05-12T19:53:39.307Z
Modified
2026-08-12T16:24:29.129270Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases
Details

ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44221.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/arcadedata/arcadedb

Affected ranges

Type
GIT
Repo
https://github.com/arcadedata/arcadedb
Events
Introduced
bf7080e0f2e6b6784a17193c03dea2a662a8063d
Fixed
04110c06315da55604ac107f71fe7182f3a3deb8
Fixed
9e708f116b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "21.10.1"
        },
        {
            "fixed": "26.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

21.*
21.10.1
21.10.2
21.11.1
21.12.1
22.*
22.1.2
22.1.3
22.10.1
22.11.1
22.12.1
22.2.1
22.6.1
22.8.1
22.9.1
23.*
23.1.1
23.1.2
23.10.1
23.11.1
23.12.1
23.12.2
23.2.1
23.3.1
23.4.1
23.5.1
23.6.1
23.7.1
23.9.1
24.*
24.1.1
24.10.1
24.11.1
24.11.2
24.2.1
24.4.1
24.5.1
24.6.1
25.*
25.1.1
25.10.1
25.11.1
25.12.1
25.2.1
25.3.1
25.3.2
25.4.1
25.6.1
25.7.1
25.8.1
25.9.1
26.*
26.1.1
26.2.1
26.3.1
26.3.2

Database specific

vanir_signatures_modified 
"2026-08-12T16:24:29Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-44221-3ded763c",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "196403731090996756698819832973191600211",
                "288187748702919502298611264404662321527",
                "53361799537177615710326442706828501264",
                "235674478627145610917944624705638630628",
                "20833599200448434381667194663903652411",
                "36661798572376615578656373791551938363",
                "134723787113868689164807399181045379426",
                "321096703820569911189907602497436339767",
                "221225822035875589052831157022384407158"
            ]
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java"
        }
    },
    {
        "id": "CVE-2026-44221-59c0a08c",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "230344429068811301568411935303419277472",
                "63061314645230032683842927130498749806",
                "68188923901810929607211446051513349897",
                "27495164444972521540168231740816895057",
                "256284677898192235708514825980213855948",
                "220728478931895524136126049439993860821",
                "211738174656659734374727450843722328037",
                "260566356864218920767064863526562922828",
                "211429954607795449517441752688367450754",
                "22879384904228457783577819261979546667",
                "74973854970781594262216896876240168675"
            ]
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "file": "server/src/test/java/com/arcadedb/server/security/CrossDatabaseAccessIT.java"
        }
    },
    {
        "id": "CVE-2026-44221-63bb9008",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 615.0,
            "function_hash": "289497144239561896615075748111755177216"
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "function": "createProperty",
            "file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java"
        }
    },
    {
        "id": "CVE-2026-44221-6e6b9940",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 394.0,
            "function_hash": "22910030154130930530951937784434918011"
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "function": "getDatabaseGroupsConfiguration",
            "file": "server/src/main/java/com/arcadedb/server/security/ServerSecurity.java"
        }
    },
    {
        "id": "CVE-2026-44221-afb2de1d",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 985.0,
            "function_hash": "95750830173832942225706208903293245402"
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "function": "createToken",
            "file": "server/src/test/java/com/arcadedb/server/security/CrossDatabaseAccessIT.java"
        }
    },
    {
        "id": "CVE-2026-44221-bccdc243",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "180462820031790772772089877945392423703",
                "159177740263817368716718253404710467884",
                "64018968295220516008297862416633451612",
                "284466947053971006954606808941637711199",
                "314183285756045540985869212682626256913",
                "169502322582343266592263365328312826600",
                "340050824025517329383993493830742215570",
                "329126408962324292976327219725207115998"
            ]
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "file": "server/src/main/java/com/arcadedb/server/security/ServerSecurity.java"
        }
    },
    {
        "id": "CVE-2026-44221-d4835956",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 816.0,
            "function_hash": "174116071749906676761343485189397119112"
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "function": "createDatabase",
            "file": "server/src/main/java/com/arcadedb/server/ArcadeDBServer.java"
        }
    },
    {
        "id": "CVE-2026-44221-ff865e6e",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "234720985032918714136864726443355038477",
                "315746088056881301192788112593014513820",
                "132317531322007116494656633967748167424"
            ]
        },
        "source": "https://github.com/arcadedata/arcadedb/commit/04110c06315da55604ac107f71fe7182f3a3deb8",
        "target": {
            "file": "server/src/main/java/com/arcadedb/server/ArcadeDBServer.java"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44221.json"