CVE-2026-75845: Arcadedata Arcadedb

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.

Affected products

• Arcadedata Arcadedb: from 26.4.2, before 26.8.1 (fixed in 26.8.1)

Published 2026-08-18. Last modified 2026-09-08.