Critical 9.0 CVSS Flaw in ArcadeDB Allows Total Cross-Database Access

ArcadeDB disclosed CVE-2026-44221 (CVSS 9.0): a critical authorization bypass caused by two architectural defects (an uninitialized fileAccessMap leading to allow-all behavior and a missing security initialization during database creation) that together permit authenticated users or tokens scoped to one database to read, write, or mutate schemas in any other database on the same server; the vendor released version 26.4.1 and recommends immediate upgrade as no workaround exists.