CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command
An attacker with read access can escalate to full administrative control by submitting asynchronous JavaScript commands that bypass authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75851?
CVE-2026-75851 is a critical vulnerability in ArcadeData arcadedb, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
Weakness: CWE-269
Which versions are affected by CVE-2026-75851?
How do I fix CVE-2026-75851?
No fix has been published for CVE-2026-75851 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-75851 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75851 exists.
Sources
Also known as GHSA-5j4x-3jfw-8xv3, GHSA-w65w-8843-879q.