ArcadeDB versions before 26.7.2 expose the cluster token through the GET /api/v1/server endpoint. The token is returned in clear text to any authenticated user. Attackers holding the token can send it in X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to mimic a root session, allowing them to create or drop users, perform arbitrary database operations, and even shut down the server. This is a disclosure of sensitive information that leads to privilege escalation through the misuse of the cluster token.

The affected product is ArcadeData’s ArcadeDB, an open‑source graph and document database. All releases prior to 26.7.2 are impacted, including 26.7.1 and earlier versions. The vulnerability is present in the API layer that serves the /api/v1/server resource.

The vulnerability carries a CVSS score of 8.7, indicating high severity. No EPSS score is available, and the issue is not in the CISA KEV catalog, suggesting no reported exploits yet. Exploitation requires valid authentication, but once an attacker obtains any authenticated session they can immediately retrieve the cluster token and abuse it. The risk is thus elevated in environments where the API is publicly reachable or where credential compromise is possible.