This CVE exposes a privilege escalation path that you need to understand if you run ArcadeDB. The vulnerability chains three elements: the UPDATE_SCHEMA permission, the trigger system, and an overly permissive JavaScript binding.
UPDATE_SCHEMA is a schema-level permission that gets granted to power users, data engineers, and application owners—people you legitimately need to give table and structure flexibility. That's the first thing to check: audit who holds UPDATE_SCHEMA in your deployment, because this permission is the entry point.
The escalation works like this: UPDATE_SCHEMA grants the ability to create triggers. ArcadeDB triggers run in a JavaScript context that receives a LocalDatabase object with HostAccess.ALL enabled. That binding gives the trigger full access to the database object, including operations that should require higher privileges—like creating server-wide admin users. So a user who should only be able to modify their table structures can instead grant themselves superuser access to the entire instance.
Version 26.7.3 addresses this by narrowing what HostAccess.ALL exposes inside trigger contexts. After upgrading, verify that your existing triggers still function correctly—some may have been relying on the overly broad access. Test your trigger definitions against the updated behavior before deploying to production.
The practical risk here is horizontal reach rather than technical depth. UPDATE_SCHEMA holders are typically a much larger population than direct admin users, so the blast radius of this vulnerability exceeds what the CVSS 8.8 score alone suggests. If you've distributed UPDATE_SCHEMA broadly, treat this as higher priority than a typical medium-high CVE.