EUVD-2026-51986
GHSA-p28w-g8xf-vm54
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low-privilege (UPDATE_SCHEMA) entry point; scope unchanged as full impact is contained within the ArcadeDB server; all three CIA dimensions compromised via admin takeover.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
AnalysisAI
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide administrator accounts by crafting malicious JavaScript triggers. The root cause is that the real LocalDatabase object is bound into trigger execution contexts with GraalVM's HostAccess.ALL policy, exposing the full Java security API - including getSecurity().createUser() - without permission checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold UPDATE_SCHEMA permission on the target ArcadeDB server, which is the permission that enables creation of JavaScript-based database triggers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the severity: network-accessible exploitation with low complexity, requiring only low-privilege (UPDATE_SCHEMA) credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with UPDATE_SCHEMA permission connects to a vulnerable ArcadeDB instance and creates a JavaScript trigger on any schema object. When the trigger fires - either triggered by the attacker themselves or by normal application activity - the JavaScript code calls getSecurity().createUser() through the exposed LocalDatabase reference, silently creating a new server-wide administrator account. … |
| Remediation | Upgrade to ArcadeDB 26.7.3 or later, which remediates the issue by restricting how the LocalDatabase object is exposed in JavaScript trigger contexts, preventing UPDATE_SCHEMA-level users from accessing the security API. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ArcadeDB deployments to identify systems running versions before 26.7.3 and immediately audit UPDATE_SCHEMA permission assignments to reduce the pool of users who can trigger this vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in ArcadeDB (arcadedb-engine) before 26.7.2 lets an authenticated user with UPDATE_SCHEMA permissio
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Privilege escalation in ArcadeDB before 26.7.3 allows any authenticated MCP user to fully bypass the database authorizat
Cleartext leakage of the HA cluster token in ArcadeDB's MCP get_server_settings tool allows any authenticated MCP user t
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today