An authenticated privilege escalation vulnerability in ArcadeDB allows attackers to create unauthorized administrator accounts.

The vulnerability arises because the system fails to bind the authenticated principal during gRPC transactions, allowing an authenticated reader to bypass scripting authorization checks and execute arbitrary JavaScript code.

The CVSS score of 9.9 highlights the severity of this privilege escalation, which grants an attacker full administrative control over the database. This allows for the manipulation of all stored data, creation of rogue accounts, and persistence within the environment, directly impacting the confidentiality and integrity of the database.

Immediate Action: Update ArcadeDB to version 26.8.1 or later to resolve the transaction executor thread binding issue.

Proactive Monitoring: Audit database logs for suspicious user activity, specifically looking for unauthorized administrative account creation or unusual JavaScript-based commands.

Compensating Controls: Strictly limit the number of users with database access and implement robust monitoring for all authenticated sessions.

Public Exploit Available: Unknown

This vulnerability poses a severe risk of administrative takeover for authenticated users. Organizations should prioritize updating to version 26.8.1 immediately to patch the authentication and authorization flaw in the gRPC transaction executor.