CVE-2026-75851

Name of the Vulnerable Software and Affected Versions ArcadeDB server versions prior to 26.8.1

Description The server fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with the awaitResponse parameter set to false, it executes on an async worker whose DatabaseContext has no bound user, which causes the scripting authorization gate to be bypassed. An attacker with read-only access to a single database can submit an asynchronous JavaScript command using the language=js parameter via the '/api/v1/command' endpoint. This allows the execution of code with unrestricted host access, such as calling the database.getSecurity().createUser() function, enabling the creation of a server-wide administrator and resulting in full administrative control.

Recommendations Update to version 26.8.1.