CVE-2026-75843

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description An issue exists where the system fails to bind the authenticated principal on the gRPC transaction executor thread within the beginTransaction function. This allows authenticated users with read-only permissions to bypass scripting authorization checks and execute JavaScript commands. By using the executeCommand function with a transaction ID, an attacker can run unrestricted JavaScript to create server-wide administrator accounts.

Recommendations Update ArcadeDB to version 26.8.1 or later.