CVE-2026-65831

Katalog CVE

CVSS 7.7 · High EPSS 0,60%

Kerentanan Improper Privilege Management. Skor CVSS 3.1 7.7 (High) menurut github.com.

Deskripsi (NVD)

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

7.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ArcadeData/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be
• https://github.com/ArcadeData/arcadedb/releases/tag/26.7.1
• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-48qw-824m-86pr