A critical authorization bypass in ArcadeDB allows database users to execute arbitrary JavaScript code by improperly defining functions.

The application incorrectly handles authorization for the SQL DEFINE FUNCTION statement when using the JavaScript language. This allows any user with database access to bypass intended security controls that should restrict scripting capabilities to administrators.

By bypassing authorization checks, an attacker can execute arbitrary JavaScript within the database engine, leading to potential data corruption, unauthorized information disclosure, or further privilege escalation. With a CVSS score of 9.8, this vulnerability represents a severe threat to the security posture of the database deployment.

Immediate Action: Update the arcadedb-engine to version 26.7.2 or later to enforce proper authorization checks on function definition statements.

Proactive Monitoring: Review application logs for the unauthorized use of DEFINE FUNCTION statements and monitor for unexpected changes to database stored procedures.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users capable of executing administrative SQL commands.

Public Exploit Available: Unknown

The ability for non-administrative users to execute arbitrary code via function definitions constitutes a critical security failure. Organizations should move quickly to apply the vendor-provided update to version 26.7.2 to restore proper authorization boundaries.