ArcadeDB versions before 26.7.3 contain a critical privilege escalation vulnerability where the real LocalDatabase object is bound into JavaScript trigger contexts with HostAccess.ALL. This misconfiguration allows users with UPDATE_SCHEMA permission to craft JavaScript triggers that invoke getSecurity().createUser() without any permission checks. As a result, schema-admins can create server-wide administrative users, escalating their privileges far beyond their authorized level. The vulnerability is exploitable by any attacker who has obtained UPDATE_SCHEMA permissions on the database. A fix is available in ArcadeDB version 26.7.3 and later. The issue has been documented in a GitHub security advisory and tracked by VulnCheck.