Get real-time updates on Telegram
CVE-2026-75845: arcadedb 26.4.2 to before 26.8.1
CVE-2026-75845. CVSS 3.1 base score 6.3 (MEDIUM, Vendor/CNA). EPSS 0.00287 (percentile 0.20072), scored 21-Oct-2026.
Affected technology
arcadedb · 26.4.2 to before 26.8.1
ArcadeData
Description’s affected range: versions 26.4.2 through 26.7.3
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
The source says setServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality, integrity and availability impact as low.
- CWE
- CWE-269
- CCR priority
- 25.3 /100 (P4)
- CVSS 3.1
- 6.3 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · Vendor/CNA
- EPSS
- 0.00287 · percentile 0.20114 · 2026-10-22
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-23 06:11:59.600832+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-23 06:11:01.814928+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-75845.html