Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-114056

ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 26.8.1 to < 26.10.1affected
  • 26.10.1unaffected
pkg:maven/com.arcadedb/arcadedb-engine

References