CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.7.3 are vulnerable due to improper binding of the LocalDatabase object in JavaScript trigger contexts, which allows schema-admins to invoke user creation functions without necessary permission checks. This flaw enables attackers with UPDATE_SCHEMA permissions to craft triggers that can escalate privileges by creating server-wide admin users. Organizations using ArcadeDB should prioritize patching to mitigate the risk of unauthorized access and privilege escalation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.