A missing principal propagation to asynchronous worker threads in ArcadeDB server lets a low-privileged read-only user execute unrestricted JavaScript and escalate to server-wide administrator (CVSS 9.9).
What Is It
ArcadeDB server (com.arcadedb:arcadedb-server) fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user. With no user bound to the context, the scripting authorization gate becomes a no-op.
The flaw is tracked as CWE-269 (Improper Privilege Management) and was disclosed via VulnCheck.
Why It Matters
A user holding only read access to a single database can submit an asynchronous JavaScript command (language=js) to the /api/v1/command endpoint and run code with unrestricted host access; for example, calling database.getSecurity().createUser to create a server-wide administrator. That is a direct path from minimal read privileges to full administrative control of the server.
Severity metrics reflect that impact:
- CVSS 3.1: 9.9 CRITICAL:
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 4.0: 9.4 CRITICAL: network attack vector, low complexity, low privileges required, no user interaction
- The scope is changed and all confidentiality, integrity, and availability impacts are HIGH, including subsequent-system impacts.
CISA's SSVC decision point data, published in the CISA Vulnrichment repository on 2026-08-18, lists exploitation status as poc (proof-of-concept available), automatable no, and technical impact total. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation in the wild.
What's Vulnerable
- Vendor: ArcadeData
- Product: ArcadeDB (
pkg:maven/com.arcadedb/arcadedb-server) - Affected: all versions before 26.8.1 (26.7.3 and earlier explicitly cited)
- Unaffected: 26.8.1 and later
The exposed surface is the HTTP /api/v1/command endpoint when commands are submitted with awaitResponse:false.
Patch Status
Fixed in ArcadeDB 26.8.1. Upgrade to 26.8.1 or later. Because the CVE is absent from the KEV catalog, there is no federal remediation deadline attached to it, and the vendor advisory describes no workaround short of upgrading.
The record was published 2026-08-18 and, per its NVD entry, remains in status Received: NVD analysis is not yet complete, and no primary CPE configurations have been published.