CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-75851 — ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fa...

·Source: NIST NVD

Updated:

Executive Summary

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single da

Analysis

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1. CVSS Score: 9.9. Published: 2026-08-18T12:19:35.457.

Indicators of Compromise (1)

CVE (1)
CVE-2026-75851
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 18, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

FDA Weighing Possible Regs for GenAI Medical Devices

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fda-weighing-possible-regs-for-generative-ai-medical-devices-image_small-6-a-32593.jpg" align=right hspace=4><b>Agency Seeks Public Input on Risk-Based Oversight Approach Across Product Life Cycle</b><br>The U.S. Food and Drug Administration is seeking public feedback on the varying risks and other considerations involving generat

Bank Info Security
MEDIUMVulnerability

When AI Risk Becomes a Board Liability

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/when-ai-risk-becomes-board-liability-image_small-9-a-32594.jpg" align=right hspace=4><b>CIOs Can Strengthen Oversight Through Reporting, Records and Insurance Reviews</b><br>AI failures can trigger financial, regulatory and reputational exposure that reaches the boardroom. Reed Smith partners Carolyn Rosenberg and Andy Moss explai

Bank Info Security
CRITICALVulnerability

Critical GitLab Zero-Click Flaw Poses Mitigation Challenges

A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478.

CVE-2026-19478
Dark Reading