Incorrect Authorization Affecting com.arcadedb:arcadedb-engine package, versions [,26.7.1)

Affected versions of this package are vulnerable to Incorrect Authorization through the PolyglotQueryEngine scripting path in engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java and GraalPolyglotEngine.java. An attacker can execute language: "js" commands against POST /api/v1/command/{database} by supplying a request as a reader-level database user, then use the bound database object to reach the JVM class loader and load classes such as java.io.File. The scripting endpoint runs without the database-administrator authorization check that SQL/Cypher paths enforce, so a low-privilege authenticated user can break out of the database scope and read files on the host filesystem, such as /etc/passwd or configuration files.

Notes

• Polyglot scripting was also reachable from other engine entry points beyond POST /api/v1/command/{database}: the same scripting path is invoked through registerFunctions and analyze, so deployments exposing those workflows inherit the issue too.
• The file-read escape was not limited to direct class lookups; the bound database object could be used to reach ClassLoader and then reflect into arbitrary classes, so sandbox configurations that relied only on an allowedPackages whitelist were still bypassable.

Workarounds

• Do not grant /api/v1/command/{database} access to untrusted users; treat any account that can reach that endpoint as capable of running polyglot scripts and reading host files.
• Restrict language: "js" and other polyglot scripting requests on the HTTP API to database-administrator users only, so reader-level accounts cannot use the scripting path to escape the database scope.

• GitHub Commit
• Maintainer's Advisory