# CVE-2026-75843: ArcadeDB gRPC transaction privilege escalation via authentication bypass

Source: https://junglewise.ai/threats/cve-2026-75843-arcadedb-grpc-transaction-privilege-escalation-via-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75843 · Severity: critical · CVSS 9.9 · Published 2026-08-18

ArcadeDB is a distributed database platform that supports JavaScript scripting and role-based access control. A flaw in the gRPC transaction handler allows any authenticated reader to bypass scripting authorization checks and execute unrestricted JavaScript code, enabling attackers to create server-wide administrator accounts and achieve full system compromise equivalent to remote code execution.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-75843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75843 being exploited in the wild.

**How severe is CVE-2026-75843?** Critical severity, with a CVSS score of 9.9, published 18 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB before 26.8.1.

**Is there a fix for CVE-2026-75843?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75843 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75843?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ArcadeDB's gRPC service fails to bind the authenticated principal (via setCurrentUser) when creating a dedicated single-thread executor for external transactions in the beginTransaction method (ArcadeDbGrpcService.java:1468-1476). When executeCommand is invoked with a transaction ID, it dispatches the command onto this executor thread where the current user context remains null. The scripting authorization gate in LocalDatabase.java:721-723 performs an early-return check that is ineffective on null users, allowing JavaScript commands to execute without UPDATE_SECURITY permission checks. An authenticated reader (low privileges) can call BeginTransaction to obtain a transaction ID, then invoke ExecuteCommand with language="js" to execute arbitrary JavaScript—for example, calling database.getSecurity().createUser() to create a server-wide administrator account. The gRPC plugin is enabled by default and shipped in the standard distribution. Patched in version 26.8.1.

## Affected products

- ArcadeData ArcadeDB before 26.8.1

## Timeline

- 2026-08-04: disclosed
- 2026-08-18: advisory

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf)
- [https://www.vulncheck.com/advisories/arcadedb-before-privilege-escalation-via-grpc-transaction](https://www.vulncheck.com/advisories/arcadedb-before-privilege-escalation-via-grpc-transaction)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)