CVE-2026-75851: Improper Privilege Management in ArcadeData arcadedb
ArcadeDB server versions 26.7.3 and earlier contain an improper privilege management vulnerability where asynchronous command worker threads do not propagate the authenticated user context. This allows a user with read-only access to execute asynchronous JavaScript commands with unrestricted host access, enabling creation of a server-wide administrator and full privilege escalation. The issue is fixed in version 26.8.1.
AI Analysis
Technical Summary
ArcadeDB server (com.arcadedb:arcadedb-server) versions 26.7.3 and earlier fail to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext lacks a bound user, causing the scripting authorization gate to be bypassed. This allows a user with read-only access on a single database to submit asynchronous JavaScript commands via the /api/v1/command endpoint to run code with unrestricted host access, such as creating a server-wide administrator user, resulting in full administrative control escalation. The vulnerability is fixed in version 26.8.1.
Potential Impact
An attacker with only read access to a single database can escalate privileges to full administrative control of the ArcadeDB server by exploiting the asynchronous command execution context lacking proper user authorization. This leads to unauthorized creation of administrator accounts and unrestricted host access, severely compromising the server's security.
Mitigation Recommendations
Upgrade ArcadeDB server to version 26.8.1 or later, where this privilege escalation vulnerability is fixed. No other mitigation or temporary workaround is specified. Patch status is confirmed fixed in 26.8.1.
CVE-2026-75851: Improper Privilege Management in ArcadeData arcadedb
Description
ArcadeDB server versions 26.7.3 and earlier contain an improper privilege management vulnerability where asynchronous command worker threads do not propagate the authenticated user context. This allows a user with read-only access to execute asynchronous JavaScript commands with unrestricted host access, enabling creation of a server-wide administrator and full privilege escalation. The issue is fixed in version 26.8.1.
CVSS v4.0
Score 9.4critical
Affected software
pkg:maven/com.arcadedb/arcadedb-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ArcadeDB server (com.arcadedb:arcadedb-server) versions 26.7.3 and earlier fail to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext lacks a bound user, causing the scripting authorization gate to be bypassed. This allows a user with read-only access on a single database to submit asynchronous JavaScript commands via the /api/v1/command endpoint to run code with unrestricted host access, such as creating a server-wide administrator user, resulting in full administrative control escalation. The vulnerability is fixed in version 26.8.1.
Potential Impact
An attacker with only read access to a single database can escalate privileges to full administrative control of the ArcadeDB server by exploiting the asynchronous command execution context lacking proper user authorization. This leads to unauthorized creation of administrator accounts and unrestricted host access, severely compromising the server's security.
Mitigation Recommendations
Upgrade ArcadeDB server to version 26.8.1 or later, where this privilege escalation vulnerability is fixed. No other mitigation or temporary workaround is specified. Patch status is confirmed fixed in 26.8.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T11:03:08.681Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a844369c6e8be0332229778
Added to database: 08/18/2026, 11:35:05 UTC
Last enriched: 08/18/2026, 11:49:45 UTC
Last updated: 08/18/2026, 12:16:30 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.