Which versions of ArcadeDB are affected by CVE-2026-75851?

ArcadeDB server versions 26.7.3 and earlier contain a critical flaw allowing any low-privileged database user to escalate to full server-wide administrative control.. A patch is available.

How to fix or mitigate CVE-2026-75851?

Within 24 hours: Identify all systems running ArcadeDB server 26.7.3 or earlier and assess network exposure. Immediately restrict or disable asynchronous JavaScript command execution (awaitResponse:false parameter) to administrative users only, or disable entirely if operationally feasible. Within 7 days: Remove or disable non-critical user accounts; implement network segmentation restricting ArcadeDB access to trusted administrative networks only; enable comprehensive audit logging of all command execution and access attempts. Within 30 days: Establish vendor monitoring protocol for patch release; evaluate alternative database platforms if ArcadeDB is mission-critical; conduct full access control audit and prepare immediate patching plan for deployment upon patch availability.

ArcadeDB CVE-2026-75851

Q: What is the CVSS score of CVE-2026-75851?

CVE-2026-75851 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-60612 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-18 VulnCheck

GHSA-w65w-8843-879q

Privilege Escalation Arcadedb Arcadedata

9.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable command endpoint with low complexity and only read-level auth (PR:L); privilege bypass escalates beyond the initial database to full server admin, so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 18, 2026 - 12:02 EUVD

Analysis Generated

Aug 18, 2026 - 11:57 vuln.today

CVE Published

Aug 18, 2026 - 11:19 cve.org

CRITICAL 9.4

DescriptionCVE.org

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

AnalysisAI

Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward.

Technical ContextAI

ArcadeDB is an open-source multi-model (graph, document, key-value, time-series, vector) database written in Java (com.arcadedb:arcadedb-server) that exposes an HTTP API including a /api/v1/command endpoint supporting scripting languages such as JavaScript (language=js). The vulnerability is a CWE-269 (Improper Privilege Management) defect: the server maintains a per-request DatabaseContext that carries the authenticated principal, but when a command is dispatched to an asynchronous worker thread (awaitResponse:false), the security context is not propagated. The scripting authorization gate that is supposed to restrict powerful host operations checks the bound user; on the async worker that user is null, so the check silently becomes a no-op, granting unrestricted host and security-API access (e.g. database.getSecurity().createUser). The affected component per CPE is cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to ArcadeDB 26.8.1, which correctly propagates the authenticated principal to asynchronous command worker threads. If immediate upgrade is not possible, apply compensating controls: block or restrict access to the /api/v1/command endpoint at a reverse proxy or WAF, particularly rejecting requests carrying awaitResponse:false, accepting that this breaks legitimate asynchronous command execution; disable or restrict server-side scripting languages (language=js) so the scripting authorization gate is not reachable, which will break any application relying on JavaScript commands; and tighten account provisioning so untrusted or low-trust users are not granted any database credentials, since PR:L means even read-only accounts are sufficient to exploit. Consult the vendor advisory GHSA-5j4x-3jfw-8xv3 (https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-5j4x-3jfw-8xv3) for authoritative guidance.