CVE-2026-75845
Received Received - Intake

Authorization Bypass in ArcadeDB MCP Server

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75845
EUVD
EUVD-2026-60609

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
arcadedb arcadedb From 26.4.2 (inc) to 26.7.3 (inc)
arcadedb arcadedb 26.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75845 is an authorization bypass vulnerability in ArcadeDB versions 26.4.2 through 26.7.3. It affects the set_server_setting MCP server-level tool where SetServerSettingTool.execute() only checks the global allowAdmin flag and does not verify the caller's role. This allows authenticated read-only users to modify server configurations when allowAdmin=true is set, even without admin privileges.

Detection Guidance

Check ArcadeDB server logs for unauthorized calls to set_server_setting by non-admin users. Monitor MCP tool invocations and verify if allowAdmin=true is set with non-root allowedUsers. Look for configuration changes in GlobalConfiguration files.

Impact Analysis

This vulnerability allows read-only users to modify server configurations, potentially causing configuration tampering or denial of service. Attackers could change settings to disrupt operations or gain unauthorized control over the server.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized users to modify server configurations. Unauthorized configuration changes may lead to improper data handling, access controls, or system integrity issues, violating regulatory requirements for data protection and security.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later. Disable allowAdmin=true if not required. Restrict allowedUsers to only trusted administrators. Review and audit server configurations for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart