CVE-2026-75843
ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
- State
- Published
- Severity
- 9.4 Critical
- Published
- Aug 18, 2026
- Updated
- Aug 18, 2026
- Reserved
- Aug 18, 2026
Description
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
arcadedbArcadeData |
|
References
- GitHub Security Advisory (GHSA-p29f-345w-4qwf)vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transactionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.