Authentication Bypass in ArcadeDB Server Affects Async Command Execution

CVE-2026-75851

What is CVE-2026-75851?

The ArcadeDB server allows unauthorized users to escalate their privileges due to a flaw in how it handles authenticated principals in asynchronous command execution. When an HTTP command is submitted with the parameter awaitResponse set to false, it executes in an async worker that lacks a bound user context, effectively disabling the security checks. This vulnerability allows a user with limited read access to a database to issue unauthorized asynchronous JavaScript commands via the /api/v1/command endpoint, potentially leading to the creation of a server-wide administrator. This issue has been addressed in version 26.8.1.

References