ArcadeDB server versions 26.7.3 and older lose the authenticated principal when executing asynchronous commands, turning the scripting authorization check into a no‑op. An attacker who already has read access to a single database can submit an asynchronous JavaScript command through the /api/v1/command endpoint and run arbitrary server‑side code with unrestricted host access. This can create a new administrator account, granting the attacker full administrative control over the server. The weakness is a classic privilege escalation flaw rooted in improper authentication handling (CWE‑269).

ArcadeData’s ArcadeDB product, specifically the server component (com.arcadedb:arcadedb-server) in release 26.7.3 and earlier versions, is affected. The vulnerable code path is exercised when an HTTP command is sent with awaitResponse set to false.

The vulnerability carries a CVSS score of 9.4, indicating critical severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based, where a remote actor can issue an HTTP request to the /api/v1/command endpoint. The attacker must possess at least read‑only access to a database to initiate the exploit; once leveraged, the privilege escalation is immediate and complete. Because no effective pre‑existing mitigation is indicated by the vendor, the risk remains high until the service is patched.