CVE-2026-75851
Received Received - Intake

ArcadeDB Server Privilege Escalation via Async Command

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75851
EUVD
EUVD-2026-60612

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)
arcadedb arcadedb 26.8.1
arcadedb arcadedb-server 26.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects ArcadeDB server versions 26.7.3 and earlier. When an HTTP command is sent with awaitResponse:false, it runs on an async worker thread without the authenticated user context. This bypasses authorization checks, allowing JavaScript commands to execute with unrestricted host access. An attacker with read-only access can create a new admin user and gain full server control.

Detection Guidance

Check ArcadeDB server version with: curl -s http://<server>:<port>/api/v1/info | grep version. If version is 26.7.3 or earlier, the system is vulnerable. Monitor HTTP POST requests to /api/v1/command with awaitResponse:false and JavaScript commands from read-only users.

Impact Analysis

If exploited, an attacker with minimal access can escalate privileges to full administrative control of the ArcadeDB server. This includes creating new admin accounts, accessing all databases, and executing arbitrary code with host system permissions. The impact is equivalent to remote code execution due to unrestricted JavaScript execution.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Full administrative access enables data exfiltration, modification, or deletion, resulting in non-compliance with these regulations and potential legal consequences.

Mitigation Strategies

Upgrade ArcadeDB server to version 26.8.1 or later immediately. Disable asynchronous JavaScript commands if not required by setting awaitResponse:true for all commands. Restrict network access to the /api/v1/command endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart