Privilege Escalation Vulnerability in ArcadeDB by The Arcade Data Company
CVE-2026-75843

9.4CRITICAL

Key Information:

Vendor

Arcadedata

Status
Arcadedb
Vendor
CVE Published:
18 August 2026

What is CVE-2026-75843?

ArcadeDB prior to version 26.8.1 contains a vulnerability that allows authenticated users to bypass authorization checks on the gRPC transaction executor thread. This flaw enables potential attackers to execute arbitrary JavaScript commands through the executeCommand function using a transaction ID, which can lead to the creation of unauthorized server-wide administrator accounts, thereby undermining the security of the system.

Affected Version(s)

arcadedb 0 < 26.8.1

arcadedb 26.8.1

References

https://github.com/ArcadeData/arcadedb/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/arcadedb-before-priv...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.