ArcadeDB versions prior to 26.7.3 bind the real LocalDatabase object into JavaScript trigger contexts using HostAccess.ALL. This binding allows schema-admin users who have UPDATE_SCHEMA permission to invoke getSecurity().createUser() within triggers without undergoing permission checks. Consequently, attackers can create triggers that execute JavaScript code to create administrative users at the server level, resulting in privilege escalation beyond their authorized scope.

An attacker with UPDATE_SCHEMA permission can escalate privileges to server-wide administrator by creating triggers that execute JavaScript with full access to user creation functions. This bypasses intended permission checks and compromises the security model, potentially allowing full control over the database server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict UPDATE_SCHEMA permissions to trusted users only and monitor trigger creation activities closely.