Privilege escalation in Arcadedata Arcadedb
CVE-2026-75843
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (36.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf (vendor-advisory)
- www.vulncheck.com/advisories/arcadedb-before-privilege-escalation-via-grpc-tran… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-75843?
- CVE-2026-75843 is a critical-severity vulnerability in Arcadedata Arcadedb, classified under Improper Privilege Management. CVSS score: 9.9/10. Published 2026-08-18.
- How severe is CVE-2026-75843?
- Critical severity. CVSS v3 base score is 9.9 out of 10.