CVE-2026-119577

MediumCVSS 6.8/10Last modified Oct 30, 2026

Description

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
ArcadeData	arcadedb	< 26.10.2

References

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1195787.8MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Pyth CVE-2026-119587.3Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker wit CVE-2026-1195867.8SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-CVE-2026-119596.9Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input CVE-2026-1195915.5SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process CVE-2026-1195964.3UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to downlo CVE-2026-1195979.8OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator CVE-2026-1195984.3Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authentic CVE-2026-1195994.3AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creati CVE-2026-11965.3A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such m CVE-2026-119606.9Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log CVE-2026-1196004.8tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending pa