https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T16:35:52.768818+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-67356 CVE-2026-67356 — ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger 2026-10-09T16:35:52.769871+00:00

Affected: ArcadeData arcadedb

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.