Privilege escalation in Arcadedata Arcadedb
CVE-2026-75843
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
Vulnerability class: Privilege Escalation
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-75843?
- CVE-2026-75843 is a critical-severity vulnerability in Arcadedata Arcadedb, classified under Improper Privilege Management. CVSS score: 9.9/10. Published 2026-08-18.
- How severe is CVE-2026-75843?
- Critical severity. CVSS v3 base score is 9.9 out of 10.