Privilege escalation in Arcadedata Arcadedb
CVE-2026-75851
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (36.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/ArcadeData/arcadedb/security/advisories/GHSA-5j4x-3jfw-8xv3 (vendor-advisory)
- www.vulncheck.com/advisories/arcadedb-before-authentication-bypass-via-async-co… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-75851?
- CVE-2026-75851 is a critical-severity vulnerability in Arcadedata Arcadedb, classified under Improper Privilege Management. CVSS score: 9.9/10. Published 2026-08-18.
- How severe is CVE-2026-75851?
- Critical severity. CVSS v3 base score is 9.9 out of 10.