CVE-2026-65831

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.

• CWE-269
• CWE-863

• https://github.com/ArcadeData/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be
• https://github.com/ArcadeData/arcadedb/releases/tag/26.7.1
• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-48qw-824m-86pr

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6582A flaw has been found in TransformerOptimus SuperAGI up to 0…7.3
• CVE-2026-65822ERPNext is a free and open source Enterprise Resource Planni…7.6
• CVE-2026-65827Docmost is open-source collaborative wiki and documentation …6.5
• CVE-2026-65828Zammad is a web based open source helpdesk/customer support …2.3
• CVE-2026-65829MPXJ is an open source library to read and write project pla…5.3
• CVE-2026-6583A vulnerability has been found in TransformerOptimus SuperAG…5.4
• CVE-2026-65832Deskflow is a keyboard and mouse sharing app. Prior to conti…8.2
• CVE-2026-65834Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-65835Capsule is a multi-tenancy and policy-based framework for Ku…6.6
• CVE-2026-65838Skipper is an HTTP router and reverse proxy for service comp…8.2
• CVE-2026-6584A vulnerability was found in TransformerOptimus SuperAGI up …5.4
• CVE-2026-65841Jodit Editor is a WYSIWYG editor with a built-in file browse…5.3