ArcadeDB versions prior to 26.7.2 contain a vulnerability in the GET /api/v1/server endpoint that fails to properly redact the cluster token (arcadedb.ha.clusterToken), exposing it in cleartext to authenticated users. An attacker who retrieves this token can use it alongside the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root user. This privilege escalation allows execution of high-impact administrative actions including user creation, database operations, and server shutdown. The vulnerability requires initial authentication but can lead to full administrative compromise. A fix is available in ArcadeDB version 26.7.2 and later. The issue has been reported via GitHub Security Advisories and VulnCheck. Organizations running ArcadeDB in high-availability cluster configurations are particularly at risk.