ArcadeDB versions prior to 26.7.2 contain a critical authorization bypass vulnerability in the SQL DEFINE FUNCTION statement when using LANGUAGE js. The flaw allows any authenticated database user to execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, circumventing security controls designed to restrict scripting capabilities to administrators only. This represents a privilege escalation risk where non-privileged database users can gain administrator-level code execution capabilities. The vulnerability has been assigned CVE-2026-67341 and is documented in both the NVD and a GitHub security advisory. Organizations using ArcadeDB should upgrade to version 26.7.2 or later immediately. No workaround short of upgrading is described in the available advisories.