# CVE-2026-75845: ArcadeDB authorization bypass in set_server_setting

Source: https://junglewise.ai/threats/cve-2026-75845-arcadedb-authorization-bypass-in-set-server-setting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75845 · Severity: medium · CVSS 6.3 · Published 2026-08-18

ArcadeDB is a multi-model database platform that includes MCP (Model Context Protocol) server functionality for remote tool execution. The set_server_setting tool allows modification of server configuration settings. A flaw in authorization logic allows any authenticated read-only user to invoke administrative server configuration changes, bypassing the intended role-based access controls. This could allow an attacker to tamper with server settings, disable functionality, or degrade performance through denial-of-service attacks.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-75845 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75845 being exploited in the wild.

**How severe is CVE-2026-75845?** Medium severity, with a CVSS score of 6.3, published 18 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB 26.4.2 through 26.7.3.

**Is there a fix for CVE-2026-75845?** A patch was published on 2026-08-18: fixed in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75845 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75845?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in SetServerSettingTool.execute() that checks only the global allowAdmin configuration flag and fails to validate the caller's role or permissions. The tool receives the authenticated ServerSecurityUser principal but never verifies whether that user is authorized for server-level administration. In MCP deployments configured with allowAdmin=true and a permissive allowedUsers list, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration properties directly. The attack requires network access to the MCP endpoint and prior authentication as a read-only user. An attacker can modify runtime-mutable settings affecting timeouts, limits, metrics, and security reload intervals, enabling configuration tampering or denial-of-service. The issue is fixed in version 26.8.1.

## Affected products

- ArcadeData ArcadeDB 26.4.2 through 26.7.3

## Timeline

- 2026-08-04: disclosed
- 2026-08-18: advisory
- 2026-08-18: patched: fixed in version 26.8.1

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-pff6-hp53-pj54](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-pff6-hp53-pj54)
- [https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-set-server-setting](https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-set-server-setting)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)