CVE-2026-54076 Details
Description
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.
A vulnerability in ArcadeDB prior to version 26.6.1 allows authenticated users, including those with read-only API tokens, to make unauthorized changes to the database schema. This issue arises because the authorization check for the UPDATE_SCHEMA permission was only applied to the LocalDocumentType.createProperty method, leaving other public schema mutators unchecked. As a result, users could use the DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY commands through the database command/query HTTP endpoints to disrupt the schema, potentially corrupting the meaning of stored records and violating the documented permission model.
Users should upgrade to ArcadeDB version 26.6.1 or later, where this vulnerability has been addressed by applying the necessary authorization checks to all public schema-mutating methods.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArcadeData/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614 | [email protected] | Source CodeVendor |
| https://github.com/ArcadeData/arcadedb/pull/4423 | [email protected] | Source CodeVendor |
| https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1 | [email protected] | Release NotesVendor |
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vg6x-6pg9-6qwg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ArcadeDB | <= 26.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |