CVE-2026-75851 in ArcadeDB
Summary
by MITRE • 08/18/2026
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in ArcadeDB versions prior to 26.8.1 represents a critical authentication bypass resulting from improper context propagation within asynchronous execution threads. The core technical flaw lies in the failure of the server to propagate the authenticated principal, specifically the user identity and associated security context, to worker threads that handle asynchronous command processing. When an HTTP request is submitted with the awaitResponse parameter set to false, the system offloads the task to a background worker thread rather than handling it synchronously on the main event loop. In this asynchronous execution path, the DatabaseContext object lacks the necessary binding of the user identity that was established during the initial authentication phase. This architectural oversight creates a significant gap in security enforcement where the context required for authorization checks is effectively nullified within the scope of these background operations.
This technical deficiency directly impacts the scripting authorization gate, which relies on the presence of a valid authenticated principal to determine permission levels. Because the asynchronous worker operates without a bound user, the system fails to enforce role-based access controls when executing JavaScript commands via the /api/v1/command endpoint with language=js specified. Consequently, any client that has been successfully authenticated and granted even minimal read-only permissions can exploit this gap by submitting malicious scripts. The authorization mechanism effectively becomes a no-op for these asynchronous requests, allowing the script to execute without verifying whether the user possesses the necessary privileges to perform administrative actions or access restricted resources.
The operational impact of this vulnerability is severe, leading to full privilege escalation and complete compromise of the database server's integrity. An attacker with low-level read access can leverage this flaw to run arbitrary JavaScript code that interacts directly with the host environment through APIs such as database.getSecurity().createUser. By utilizing these unrestricted capabilities, an adversary can create a new user account with administrator privileges, thereby gaining full control over the entire ArcadeDB instance. This escalation allows for unauthorized data exfiltration, modification of critical system configurations, and potential lateral movement within the network infrastructure depending on how the database server is integrated into broader application architectures. The ability to execute code with unrestricted host access further exacerbates the risk by potentially enabling remote code execution scenarios if additional vectors are present in the underlying Java runtime environment.
To mitigate this vulnerability, organizations must immediately upgrade ArcadeDB servers to version 26.8.1 or later where the context propagation issue has been resolved and security checks are correctly enforced across all execution threads. In environments where upgrading is not immediately feasible, temporary mitigations should include restricting network access to the /api/v1/command endpoint to only trusted internal services and ensuring that no users have direct API access without robust additional authentication layers such as mutual TLS or strict IP whitelisting. Furthermore, implementing comprehensive logging for asynchronous command executions can aid in detecting potential exploitation attempts by monitoring for unusual patterns of JavaScript execution from low-privilege accounts. This incident underscores the importance of rigorous context management in multi-threaded applications and highlights common pitfalls associated with CWE-287 Improper Authentication and CWE-940 Improper Authorization of Privileged Accounts, as well as techniques aligned with ATT&CK T1068 Exploitation for Privilege Escalation.