ArangoDB privilege escalation via the isSystem task flag. RestTasksHandler read isSystem from the POST /_api/tasks request body and passed it straight to Task::createTask() with no privilege check, letting a database user with write permissions schedule a JavaScript task that runs in a privileged internal context; in the official containers arangod runs as root, so this reaches root-level file operations and code execution. The V8 path enforced securityContext.isInternal() while the REST path enforced nothing. Affects releases up to and including 3.12.10.1; fixed in 3.12.11 by requiring exec.isSuperuserOrDisabled().