medium · CVSS v3 4.3

CVE-2026-114056

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SC

Overview

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SCHEMA rights. This change persists across restarts and can affect data integrity.

Description

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.

Impact

Confidentiality: potential exposure of schema changes; Integrity: unauthorized schema modifications; Availability: minimal direct impact but could lead to downstream errors. Defenders: database administrators and security teams must verify schema integrity and monitor for unauthorized ALTER TYPE commands.

Remediation

Upgrade to ArcadeDB 26.10.1 or later. If upgrade not possible, restrict HTTP/gRPC/Bolt endpoints to authenticated users with UPDATE_SCHEMA permission, or enforce role‑based access control to prevent read‑only users from executing ALTER TYPE. Monitor logs for ALTER TYPE commands and audit schema changes.

Risk context

Medium severity; CVSS v3 score 4.3 indicates moderate risk. No EPSS data available. Defenders should treat as a moderate priority but not critical.

Affected products

  • ArcadeDB
  • ArcadeDB 26.8.1-26.10.0

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
—

authorization-bypass schema-modification ArcadeDB read-only edge-type medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing flaw that lets authenticated users collide cache keys via EXIF ImageID or cache_salt, potentially leaking cached media or reusing KV state. The vulnerability can be exploited by supplying crafted values in image metadata or LoRA names. It affects all deployments of vLLM older than 0.31.0.

View analysis

medium

CVE-2026-114057

ArcadeDB versions 26.2.1 through 26.10.0 allow authenticated users to enumerate all database names via the Bolt protocol, exposing tenant or project identifiers. The missing authorization flaw can be triggered with a simple SHOW DATABASES query. This vulnerability is present in the Bolt handler and can be exploited by any user with database credentials.

View analysis

medium

CVE-2026-114058

ArcadeDB versions 26.2.1 through 26.10.0 have a missing authorization check in the Bolt protocol. Authenticated users can read schema metadata of other databases by manipulating the db field in RUN or BEGIN messages. This allows enumeration of unauthorized schemas.

View analysis