ArcadeDB Server <= 26.7.3 Vulnerability: Critical Authorization Bypass
- Severity
- CRITICAL
- CVSS
- 9.9
- Affected component
- arcadedb-server (npm)
- Affected versions
- >= untagged-3026f5635164cd300b5b, <= untagged-3026f5635164cd300b5b or >= 26.7.2, <= 26.7.2 or >= 26.7.1, <= 26.7.1 or >= 26.6.1, <= 26.6.1 or >= 26.5.1, <= 26.5.1 or >= 26.4.2, <= 26.4.2 or >= 26.3.2, <= 26.3.2 or >= 26.3.1, <= 26.3.1 or >= 26.2.1, <= 26.2.1 or >= 26.1.1, <= 26.1.1 or >= 25.12.1, <= 25.12.1 or >= 25.11.1, <= 25.11.1 or >= 25.10.1, <= 25.10.1 or >= 25.9.1, <= 25.9.1 or >= 25.8.1, <= 25.8.1 or >= 25.7.1, <= 25.7.1 or >= 25.6.1, <= 25.6.1 or >= 25.4.1, <= 25.4.1 or >= 25.3.2, <= 25.3.2 or >= 25.3.1, <= 25.3.1 or >= 25.2.1, <= 25.2.1 or >= 25.1.1, <= 25.1.1 or >= 24.11.2, <= 24.11.2 or >= 24.11.1, <= 24.11.1 or >= 24.10.1, <= 24.10.1 or >= 24.6.1, <= 24.6.1 or >= 24.5.1, <= 24.5.1 or >= 24.4.1, <= 24.4.1 or >= 24.2.1, <= 24.2.1 or >= 24.1.1, <= 24.1.1 or >= 23.12.2, <= 23.12.2 or >= 23.12.1, <= 23.12.1 or >= 23.11.1, <= 23.11.1 or >= 23.10.1, <= 23.10.1 or >= 23.9.1, <= 23.9.1 or >= 23.7.1, <= 23.7.1 or >= 23.6.1, <= 23.6.1 or >= 23.5.1, <= 23.5.1 or >= 23.4.1, <= 23.4.1 or >= 23.3.1, <= 23.3.1 or >= 23.2.1, <= 23.2.1 or >= 23.1.2, <= 23.1.2 or >= 23.1.1, <= 23.1.1 or >= 22.12.1, <= 22.12.1 or >= 22.11.1, <= 22.11.1 or >= 22.10.1, <= 22.10.1 or >= 22.9.1, <= 22.9.1 or >= 22.8.1, <= 22.8.1 or >= 22.6.1, <= 22.6.1 or >= 22.2.1, <= 22.2.1 or >= 22.1.3, <= 22.1.3 or >= 22.1.2, <= 22.1.2 or >= 21.12.1, <= 21.12.1 or >= 21.11.1, <= 21.11.1 or >= 21.10.2, <= 21.10.2 or >= 21.10.1, <= 21.10.1 or >= 21.9.1, <= 21.9.1
- Patched version
- 26.8.1
An early warning has been issued for a critical vulnerability in ArcadeDB server versions 26.7.3 and earlier. This flaw allows users with read access to escalate to full administrative control.
What happened
ArcadeDB server versions 26.7.3 and earlier reportedly contain a critical vulnerability that fails to propagate the authenticated principal to asynchronous command worker threads. This oversight permits a user with read access to a single database to execute unrestricted JavaScript commands, potentially leading to the creation of a server-wide administrator account and full administrative control. The issue is fixed in version 26.8.1.
The vulnerability is tracked under CVE-2026-75851 with a CVSS score of 9.9, indicating its critical severity. It has not been reported as exploited in the wild as of the latest information. Users of affected versions are advised to upgrade to mitigate potential risks.
What to do about it
- Immediately upgrade your ArcadeDB server to version 26.8.1 or later.
- Review your server's access logs for any unauthorized administrative activities.
- Consider implementing additional monitoring for unusual database activities.
- Ensure that all database users have the minimum necessary permissions.
- Stay informed by monitoring updates from the official ArcadeDB and NVD sources.
How 0Day would have caught this
arcadedb-server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using ArcadeDB server version 26.7.3 or earlier, you are potentially affected.
What should I do right now?
Upgrade to ArcadeDB server version 26.8.1 or later as soon as possible.
Has this been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.
Where can I find more information?
Consult the NVD page for CVE-2026-75851 and the official ArcadeDB documentation for the latest updates and guidance.