Description

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-18T12:19:35.457Z",
  "pubdate": "2026-08-18T12:19:35.457Z",
  "executiveSummary": "An authentication context propagation vulnerability exists in the ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier. The flaw allows authenticated low-privileged users to bypass scripting authorization controls completely.\nThe vulnerability occurs when processing HTTP commands submitted with the awaitResponse:false parameter. These asynchronous requests execute on worker threads where the DatabaseContext fails to bind the authenticated principal, causing the authorization gate to become a no-op.\nAn attacker possessing only read access to a single database can leverage this defect by submitting an asynchronous JavaScript command via the /api/v1/command endpoint. This grants unrestricted host access and allows the creation of a server-wide administrator account, leading to complete system compromise and full administrative control.\nThe risk is severe due to the direct path from low-privileged database read access to full administrative takeover. Remediation requires upgrading the affected software to version 26.8.1 or later where the context propagation defect is resolved.",
  "technicalDetails": "The root cause of the vulnerability resides in the asynchronous command handling mechanism of the ArcadeDB server. When an HTTP command request is processed with the parameter awaitResponse:false, the execution is offloaded to an asynchronous command worker thread.\nDuring this offloading process, the server fails to propagate the authenticated principal from the original HTTP session to the DatabaseContext of the async worker thread. As a result, the DatabaseContext has no bound user associated with it.\nThe vulnerable component is the scripting authorization gate within the command execution pipeline. Because no user principal is present in the thread's DatabaseContext, the security checks function as a no-op, bypassing all role-based and permission-based restrictions enforced during synchronous command execution.\nThe attack flow proceeds as follows: First, an attacker authenticates with minimal privileges, specifically holding only read access to a single database. Second, the attacker crafts an HTTP POST request targeting the /api/v1/command endpoint. Third, the request body includes a scripting command, such as JavaScript specified via language=js, along with the awaitResponse:false parameter.\nUpon submission, the request executes on the unauthenticated async worker thread. The script executes with unrestricted host access rather than being restricted by the invoking user's limited permissions.\nThe payload behavior allows the execution of administrative API calls within the scripting environment, such as invoking database.getSecurity().createUser. This enables the attacker to programmatically instantiate a new server-wide administrator account.\nThe post-exploitation impact includes complete loss of confidentiality, integrity, and availability of the database server, as the attacker achieves full administrative control over the entire ArcadeDB instance from an initial state of low-privileged read access."
}