Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2026-75843

ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.8.1affected
  • 26.8.1unaffected
pkg:maven/com.arcadedb/arcadedb-grpcw

References