CVE-2026-75843 describes a critical improper privilege management vulnerability in ArcadeDB before version 26.8.1. The flaw arises from failure to bind the authenticated principal on the gRPC transaction executor thread in the beginTransaction method. This allows authenticated users with only reader privileges to execute JavaScript commands without proper authorization checks. Attackers can use the executeCommand function with a transaction ID to run unrestricted JavaScript code, including commands that create administrator accounts across the server, effectively escalating privileges to full administrative control.

An attacker with authenticated reader access can escalate privileges by executing arbitrary JavaScript commands without authorization checks. This can lead to creation of server-wide administrator accounts, resulting in complete compromise of the affected ArcadeDB server. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to trusted users only and monitor for suspicious use of JavaScript commands within transactions. Avoid exposing the database to untrusted networks or users.