A missing principal binding on ArcadeDB's gRPC transaction executor thread allows any authenticated low-privilege user to run unrestricted JavaScript on the server and create server-wide administrator accounts.
What Is It
CVE-2026-75843 is a privilege management flaw (CWE-269) in ArcadeDB before version 26.8.1. The beginTransaction call on the gRPC interface fails to bind the authenticated principal to the transaction executor thread. Because the executor thread carries no principal, the scripting authorization checks that would normally gate JavaScript execution never fire.
An attacker holding nothing more than reader credentials can call executeCommand with a valid transaction ID and run arbitrary, unrestricted JavaScript; including commands that provision server-wide administrator accounts.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and a CVSS 4.0 score of 9.4 (Critical). It is network-reachable, low-complexity, requires no user interaction, and needs only low privileges. The C:H/I:H/A:H metrics rate total loss of confidentiality, integrity, and availability on the impacted component, and S:C (Scope: Changed) indicates that the impacted component is not the vulnerable one; the consequences escape the database's own authorization boundary and reach the wider server.
CISA's SSVC assessment records exploitation status as proof-of-concept, technical impact as total, and automatable as no. The CVE does not appear in the CISA KEV catalog, so there is no confirmation of active in-the-wild exploitation and no KEV-mandated remediation deadline.
The practical takeaway: in any ArcadeDB deployment where low-trust accounts exist, analytics readers, application service accounts, tenant users, the boundary between "read-only" and "server administrator" does not hold.
What's Vulnerable
- Vendor: ArcadeData
- Product: ArcadeDB (
pkg:maven/com.arcadedb/arcadedb-grpcw) - Affected: all versions before 26.8.1
- Not affected: 26.8.1 and later
No CPE entries were published in the NVD record at the time of writing. Exposure is tied to the gRPC transaction interface, so deployments with gRPC enabled and reachable by authenticated users are the relevant population.
Patch Status
Upgrade ArcadeDB to 26.8.1 or later. The NVD record lists 26.8.1 as unaffected. Neither the GitHub Security Advisory nor the VulnCheck advisory specifies a workaround for unpatched deployments. The NVD record was published 2026-08-18 and remains in Received status, so scoring and affected-product data may still change.