EUVD-2026-51986
GHSA-p28w-g8xf-vm54
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low-privilege (UPDATE_SCHEMA) entry point; scope unchanged as full impact is contained within the ArcadeDB server; all three CIA dimensions compromised via admin takeover.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
AnalysisAI
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide administrator accounts by crafting malicious JavaScript triggers. The root cause is that the real LocalDatabase object is bound into trigger execution contexts with GraalVM's HostAccess.ALL policy, exposing the full Java security API - including getSecurity().createUser() - without permission checks. No public exploit has been identified at time of analysis, but a vendor-released patch is available in 26.7.3 per the GitHub security advisory GHSA-38pf-6hp2-pxww.
Technical ContextAI
ArcadeDB is a multi-model database engine (graph, document, key-value, time-series) that supports JavaScript-based triggers via GraalVM's Polyglot API. The vulnerability arises because the real LocalDatabase Java object is injected into trigger contexts with HostAccess.ALL, bypassing GraalVM's sandbox capabilities entirely and exposing the full Java object graph - including the internal security subsystem - to executing JavaScript. A schema-admin can exploit this by calling getSecurity().createUser() through the LocalDatabase reference, a method normally gated behind explicit administrative permissions. CWE-269 (Improper Privilege Management) is the precise root cause: the system fails to enforce the intended permission boundary between UPDATE_SCHEMA (schema operations) and server-wide user administration. The affected CPE is cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*, covering all releases before 26.7.3.
RemediationAI
Upgrade to ArcadeDB 26.7.3 or later, which remediates the issue by restricting how the LocalDatabase object is exposed in JavaScript trigger contexts, preventing UPDATE_SCHEMA-level users from accessing the security API. The vendor advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-38pf-6hp2-pxww should be consulted for upgrade guidance. If immediate patching is not feasible, the most targeted compensating control is to audit and revoke UPDATE_SCHEMA permissions from all accounts that do not have a strict operational requirement for them - note this will break legitimate schema modification workflows and must be weighed accordingly. As a secondary control, disable JavaScript trigger functionality at the server configuration level if triggers are not actively used in production, which eliminates the attack surface entirely without affecting non-trigger workloads.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today