Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-75843ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction

Critical 9.9

In plain English

A critical-severity privilege mismanagement in arcadedb from ArcadeData. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

Affected products (as reported)

Vendor	Product	Versions
ArcadeData	arcadedb	0 – before 26.8.1

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-p29f-345w-4qwf) vendor-advisory
VulnCheck Advisory: ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction third-party-advisory