Executive brief
ArcadeDB is a multi-model database server that supports scripting through HTTP commands. A read-only user can exploit asynchronous command execution to bypass security checks and create server-wide administrator accounts, gaining complete control over the database server and all its data. This allows an attacker with minimal initial access to assume full administrative privileges without requiring additional authentication or interaction.
Technical details
The vulnerability is a privilege escalation caused by improper propagation of authentication context in asynchronous command execution. When a user submits an HTTP POST to /api/v1/command with awaitResponse:false, the command is dispatched to an arcadedb-async-* worker thread whose DatabaseContext is never bound to the authenticated principal. The scripting authorization gate in PolyglotQueryEngine.command() explicitly returns early when no user is bound (a documented no-op), allowing JavaScript code to execute with unrestricted host access. An attacker with only read access to a single database can call database.getSecurity().createUser() to create an all-databases administrator account. Attack vector is network; low privilege (read-only database access) and low complexity required. The fix propagates the authenticated principal to async worker threads and calls setCurrentUser before command execution.
Affected products
- ArcadeData ArcadeDB 26.7.3 and earlier; fixed in 26.8.1
Timeline
- 2026-08-04: disclosed: GitHub Security Advisory published
- 2026-08-18: advisory: NVD entry published
- 2026-08-18: patched: Fix released in ArcadeDB 26.8.1