CVE-2026-75843: Improper Privilege Management in ArcadeData arcadedb
CVE-2026-75843 is a critical vulnerability in ArcadeData's arcadedb prior to version 26.8.1. The flaw involves improper privilege management where the authenticated principal is not correctly bound on the gRPC transaction executor thread during beginTransaction. This allows authenticated users with reader privileges to bypass scripting authorization checks and execute unrestricted JavaScript commands. Exploitation can lead to creation of server-wide administrator accounts, severely compromising the database server.
AI Analysis
Technical Summary
ArcadeDB versions before 26.8.1 fail to bind the authenticated principal on the gRPC transaction executor thread in the beginTransaction method. This improper privilege management permits authenticated readers to execute JavaScript commands without passing scripting authorization checks. Attackers can leverage the executeCommand function with a transaction ID to run unrestricted JavaScript, enabling them to create administrator accounts with server-wide privileges.
Potential Impact
The vulnerability allows authenticated users with limited privileges (readers) to escalate their privileges by executing arbitrary JavaScript commands without authorization checks. This can result in the creation of administrator accounts, leading to full control over the database server and potential compromise of all stored data and operations.
Mitigation Recommendations
Upgrade to ArcadeDB version 26.8.1 or later where this issue is fixed. Versions prior to 26.8.1 are vulnerable. No other mitigation or temporary workaround is indicated in the provided data.
CVE-2026-75843: Improper Privilege Management in ArcadeData arcadedb
Description
CVE-2026-75843 is a critical vulnerability in ArcadeData's arcadedb prior to version 26.8.1. The flaw involves improper privilege management where the authenticated principal is not correctly bound on the gRPC transaction executor thread during beginTransaction. This allows authenticated users with reader privileges to bypass scripting authorization checks and execute unrestricted JavaScript commands. Exploitation can lead to creation of server-wide administrator accounts, severely compromising the database server.
CVSS v4.0
Score 9.4critical
Affected software
ArcadeData
arcadedb
pkg:github/arcadedata/arcadedbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ArcadeDB versions before 26.8.1 fail to bind the authenticated principal on the gRPC transaction executor thread in the beginTransaction method. This improper privilege management permits authenticated readers to execute JavaScript commands without passing scripting authorization checks. Attackers can leverage the executeCommand function with a transaction ID to run unrestricted JavaScript, enabling them to create administrator accounts with server-wide privileges.
Potential Impact
The vulnerability allows authenticated users with limited privileges (readers) to escalate their privileges by executing arbitrary JavaScript commands without authorization checks. This can result in the creation of administrator accounts, leading to full control over the database server and potential compromise of all stored data and operations.
Mitigation Recommendations
Upgrade to ArcadeDB version 26.8.1 or later where this issue is fixed. Versions prior to 26.8.1 are vulnerable. No other mitigation or temporary workaround is indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T10:59:33.701Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a844367c6e8be0332229752
Added to database: 08/18/2026, 11:35:03 UTC
Last enriched: 09/11/2026, 23:02:01 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.