ArcadeDB fails to bind the authenticated user to the gRPC transaction executor thread during beginTransaction. As a result, authenticated readers can invoke executeCommand with a transaction ID and run untrusted JavaScript without any scripting authorization checks. This allows an attacker to execute arbitrary server‑side code, including creating administrator accounts, leading to complete privilege escalation.

The vulnerability affects ArcadeData's ArcadeDB product in all versions earlier than 26.8.1. Systems running a pre‑26.8.1 build are at risk.

The CVSS score of 9.4 classifies this flaw as critical. EPSS is not available, but the lack of KEV listing does not diminish the high impact of unauthorized privileged escalation. Attackers must first authenticate as a reader and then use the gRPC interface to begin a transaction; the privileged execution is achieved without further checks. The attack vector involves legitimate authorization but insufficient bounding of identity on the transaction thread, making it exploitable over the internal gRPC port by anyone with reader credentials.