CVE-2026-75851: Improper Privilege Management in ArcadeData arcadedb
ArcadeDB server versions up to 26.7.3 have an improper privilege management vulnerability where asynchronous command worker threads do not inherit the authenticated user's context. This allows users with read-only access to execute asynchronous JavaScript commands with unrestricted host access, enabling them to escalate privileges and create server-wide administrators. The issue is fixed in version 26.8.1.
AI Analysis
Technical Summary
ArcadeDB server (com.arcadedb:arcadedb-server) versions 26.7.3 and earlier fail to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext lacks a bound user, causing the scripting authorization gate to be bypassed. This allows a user with read-only access to submit asynchronous JavaScript commands via the /api/v1/command endpoint that run code with unrestricted host access, such as database.getSecurity().createUser, enabling creation of a server-wide administrator and full administrative control. The vulnerability is addressed in version 26.8.1.
Potential Impact
An attacker with read-only access to a single database can escalate privileges to full administrative control over the ArcadeDB server by exploiting the lack of user context propagation in asynchronous command execution. This leads to unauthorized creation of server-wide administrators and unrestricted host access, posing a critical security risk.
Mitigation Recommendations
Upgrade ArcadeDB server to version 26.8.1 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed as an official fix in 26.8.1.
CVE-2026-75851: Improper Privilege Management in ArcadeData arcadedb
Description
ArcadeDB server versions up to 26.7.3 have an improper privilege management vulnerability where asynchronous command worker threads do not inherit the authenticated user's context. This allows users with read-only access to execute asynchronous JavaScript commands with unrestricted host access, enabling them to escalate privileges and create server-wide administrators. The issue is fixed in version 26.8.1.
CVSS v4.0
Score 9.4critical
Affected software
ArcadeData
arcadedb
pkg:maven/com.arcadedb/arcadedb-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ArcadeDB server (com.arcadedb:arcadedb-server) versions 26.7.3 and earlier fail to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext lacks a bound user, causing the scripting authorization gate to be bypassed. This allows a user with read-only access to submit asynchronous JavaScript commands via the /api/v1/command endpoint that run code with unrestricted host access, such as database.getSecurity().createUser, enabling creation of a server-wide administrator and full administrative control. The vulnerability is addressed in version 26.8.1.
Potential Impact
An attacker with read-only access to a single database can escalate privileges to full administrative control over the ArcadeDB server by exploiting the lack of user context propagation in asynchronous command execution. This leads to unauthorized creation of server-wide administrators and unrestricted host access, posing a critical security risk.
Mitigation Recommendations
Upgrade ArcadeDB server to version 26.8.1 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed as an official fix in 26.8.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T11:03:08.681Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a844369c6e8be0332229778
Added to database: 08/18/2026, 11:35:05 UTC
Last enriched: 09/11/2026, 22:19:04 UTC
Last updated: 10/02/2026, 12:25:39 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.