What is CVE-2026-67356?
This vulnerability in ArcadeDB (before version 26.7.3) occurs due to the real LocalDatabase object being improperly bound into JavaScript trigger contexts. An attacker with UPDATE_SCHEMA permission can create triggers via JavaScript that call getSecurity().createUser() without permission checks, leading to unauthorized user creation. Immediate update to version 26.7.3 is recommended.
Azərbaycanca: Bu boşluq ArcadeDB-də (26.7.3-dən əvvəlki versiyalarda) JavaScript trigger kontekstinə LocalDatabase obyektinin səhvən bağlanmasından qaynaqlanır. UPDATE_SCHEMA icazəsi olan hücumçu, icazə yoxlaması olmadan getSecurity().createUser() çağırışı ilə yeni istifadəçi yarada bilər. Dərhal 26.7.3 versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-862; shared vendor: ArcadeDB
FAQ2
What is the main prerequisite to exploit the CVE-2026-67356 vulnerability?
The attacker must have UPDATE_SCHEMA permission in ArcadeDB to call getSecurity().createUser() without permission checks within JavaScript trigger contexts.
What action should be taken to protect against this security issue?
ArcadeDB should be immediately updated to version 26.7.3, as the vulnerability exists in all versions prior to this release.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.