by Kastro
Paper/Archive/CVE-2026-75851

CVE-2026-75851

ArcadeData arcadedb — ArcadeDB before 26.8.1 Authentication Bypass via Async Command

EPSS 0.4%public exploitCVSS 9.9
critical.is priorityof 100
46
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 33.3.333 × 206.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

Affected

ProductAffectedFixed inSource
arcadedb< 26.8.126.8.1CNA

Scores by source

VulnCheck (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/ArcadeData/arcadedb/security/advisories/GHSA-5j4x-3jfw-8xv3writeupvulncheck.com/advisories/arcadedb-before-authentication-bypass-via-async-command