Reader-to-admin escalation via unbound gRPC principal

Improper privilege management in Arcade Data ArcadeDB before 26.8.1 lets remote authenticated users gain server-wide administrator access via gRPC. ArcadeDbGrpcService.beginTransaction starts a dedicated transaction executor thread without setCurrentUser, and executeCommand later reuses that thread to run LANGUAGE js with a null principal, causing checkScriptingPermissions to return before enforcing UPDATE_SECURITY. Any authenticated reader who can reach the default-enabled gRPC interface can open a transaction, reuse its transaction ID, and create a server-wide administrator account; the advisory notes that JavaScript host access makes the result RCE-equivalent.