CVE-2026-75845

Name of the Vulnerable Software and Affected Versions ArcadeDB versions 26.4.2 through 26.7.3

Description An authorization bypass exists in the set server setting MCP server-level tool. The SetServerSettingTool.execute() function only checks the global allowAdmin flag and fails to verify the role of the caller. In deployments where allowAdmin is set to true and a non-root allowedUsers list is configured, any authenticated read-only user can use the set server setting tool to modify the server GlobalConfiguration. This can lead to configuration tampering or a denial of service.

Recommendations Update to version 26.8.1.