Server admin escalation via async JS command

Privilege escalation in Arcade Data ArcadeDB before 26.8.1 allows remote authenticated users to create a server-wide administrator via /api/v1/command. PostCommandHandler passes attacker-controlled language and awaitResponse values into executeCommandAsync, and the arcadedb-async worker initializes DatabaseContext without setCurrentUser, so the JavaScript scripting permission check returns early on a null principal. Exploitation requires valid low-privilege database credentials and the HTTP command endpoint, but a read-only user can then call database.getSecurity().createUser(...) and gain server-wide administrative control.