ArcadeDB before version 26.7.3 exposes the real LocalDatabase object inside JavaScript trigger contexts with HostAccess.ALL, allowing users who possess schema‑admin privileges to call getSecurity().createUser() without the necessary permission checks. Attackers who have UPDATE_SCHEMA rights can therefore fabricate triggers that execute JavaScript code to create server‑wide administrative accounts, effectively bypassing established authorization controls. The weakness is an improper privilege escalation flaw, classified under CWE-269.

ArcadeDB instances from ArcadeData with a version prior to 26.7.3 are affected. These versions will not protect against the described privilege escalation when schema‑admins or users with UPDATE_SCHEMA rights create JavaScript triggers.

The vulnerability is rated with a CVSS score of 8.7, indicating a high severity. The EPSS score is not available and the issue is not listed in CISA KEV. Attackers must have UPDATE_SCHEMA permission, which is typically granted to trusted or administrative users; therefore the likely attack vector is an internal or compromised account with sufficient schema modification rights, but could be leveraged over the network if such permissions are granted remotely. The flaw provides a clear path to create privileged accounts, leading to full compromise of the database environment.