CVE-2026-75845 ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting
Authenticated read-only users can modify server settings and cause denial of service in ArcadeDB when admin features are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75845?
CVE-2026-75845 is a medium-severity missing authorization vulnerability in ArcadeData arcadedb, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.
Weakness: CWE-269
Which versions are affected by CVE-2026-75845?
How do I fix CVE-2026-75845?
No fix has been published for CVE-2026-75845 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-75845 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75845 exists.
Sources
Also known as GHSA-2c26-2qqv-6r9c, GHSA-pff6-hp53-pj54.