CVE-2026-119576 Details
Description
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.
A vulnerability in ArcadeDB versions 21.12.1 prior to 26.10.2 allows users with only readRecord permissions to bypass authorization and replace the shared GraphQL schema through the read-only query endpoint. Affected users can send a GraphQL type definition containing a crafted @sql directive to the query endpoint, altering the query results for other users, including administrators. This issue arises because the GraphQL schema is a shared state within the database, and read-only users can modify the data returned to other GraphQL clients without the necessary schema rights.
Users are advised to upgrade to ArcadeDB version 26.10.2 or later. In the patched version, GraphQL type definitions sent to the read-only query endpoint are now treated as schema changes and require the updateSchema right to be executed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-773f-9j7c-cr54 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-773f-9j7c-cr54 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/arcadedb-from-21.12.1-before-26.10.2-graphql-schema-replacement-via-read-only-query-endpoint | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ArcadeDB | <= 26.10.1 (semver) >= 21.12.1, < 26.10.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |