An authenticated privilege escalation vulnerability in ArcadeDB allows attackers to gain full administrative control over the database server.

The vulnerability stems from improper privilege management where authenticated sessions fail to propagate to asynchronous command worker threads. An attacker with low-level read access can submit a specially crafted asynchronous JavaScript command to execute unauthorized operations, effectively bypassing the authorization gate.

This vulnerability allows an attacker to escalate from a restricted user account to a full server-wide administrator. This level of access grants the attacker the ability to manipulate all data, create new administrative accounts, and potentially compromise the underlying host system. The CVSS score of 9.9 highlights the extreme severity of this privilege escalation.

Immediate Action: Upgrade to ArcadeDB version 26.8.1 or later to ensure proper thread context and authorization handling.

Proactive Monitoring: Monitor database audit logs for suspicious administrative actions or unauthorized attempts to create users by non-privileged accounts.

Compensating Controls: Restrict access to the /api/v1/command endpoint and implement strict network segmentation to limit the reach of compromised database instances.

Public Exploit Available: No (unknown)

Organizations using ArcadeDB must treat this as a high-priority update. Upgrading to 26.8.1 is the only reliable way to prevent unauthorized privilege escalation and protect the integrity of the database environment.