CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-75851 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.7.1, =26.7.3 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-75851 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.4.2, <=26.7.3), com.arcadedb:arcadedb-graphql (>=26.4.2, <=26.7.3) +10 more potentially affected by CVE-2026-75845 via com.arcadedb:arcadedb-server (>=26.4.2, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.4.2, =26.7.1, =26.7.3 Source cves: CVE-2026-75845 Source advisory: MEND:CVE-2026-75845...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-75841 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.7.1, =26.7.3 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-75841 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-75839 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.7.1, =26.7.3 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-75839 Source advisory:...

CVE-2026-75851: Improper Privilege Management

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

com.arcadedb:arcadedb-bolt (>=26.3.2, <=26.7.2), com.arcadedb:arcadedb-graphql (>=26.3.2, <=26.7.2) +10 more potentially affected by CVE-2026-67357 via com.arcadedb:arcadedb-server (>=26.3.2, <=26.7.2)

com.arcadedb:arcadedb-server MAVEN version =26.3.2, =26.3.2, =26.3.2, =26.3.2, =26.3.2, =26.4.2, =26.3.2, =26.3.2, =26.3.2, =26.3.2, =26.3.2, =26.3.2, =26.7.1, =26.7.2 Source cves: CVE-2026-67357 Source advisory: MEND:CVE-2026-67357...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +12 more potentially affected by CVE-2026-67342 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =26.4.2, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.5.1 - com.arcadedb:arcadedb-tracing 26.7.1 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-673...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.3.2), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +10 more potentially affected by CVE-2026-44221 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.3.2)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.3.2 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-44221 Source advisory: MEND:CVE-2026-44221...

Authorization Bypass

com.arcadedb, arcadedb-server is vulnerable to Authorization Bypass. The vulnerability is due to improper initialization of access controls and missing security configuration during database creation, which allows an attacker to bypass database and record-level authorization restrictions...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.3.2), com.arcadedb:arcadedb-coverage (>=21.10.1, <=25.4.1) +10 more potentially affected by CVE-2026-44221 via com.arcadedb:arcadedb-server (>=21.10.1, <=26.3.2)

com.arcadedb:arcadedb-server MAVEN version =21.10.1, =26.2.1, =21.10.1, =21.12.1, =24.11.1, =25.9.1, =25.1.1, =21.10.1, =21.10.1, =21.10.1, =21.10.1, =25.11.1, =26.3.2 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-44221 Source advisory: GHSA-FXC7-FM93-6Q77...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization n the ServerSecurityUser.getDatabaseUser and ArcadeDBServer.createDatabase processes. An attacker can gain unauthorized access to read, write, and modify schema and data across databases by exploiting improper...