CVE-2026-114056 in ArcadeDB
Summary
by MITRE • 10/21/2026
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability in ArcadeDB versions prior to 26.10.1 represents a critical authorization bypass within the database schema management subsystem. This flaw specifically affects users who have been granted read-only permissions but are inadvertently allowed to execute commands that modify structural definitions of edge types. The core technical failure lies in the insufficient validation of user privileges when processing ALTER TYPE directives, particularly those targeting lightweight and unique schema flags for edges. In a properly secured database environment, modifications to schema structures such as changing an edge type from non-lightweight to lightweight or altering its uniqueness constraints should require elevated privileges, specifically UPDATE_SCHEMA permission. However, due to this oversight in the access control logic, authenticated users with only read capabilities can successfully execute these administrative commands through various supported interfaces including HTTP, gRPC, and Bolt command APIs.
From a technical perspective, the vulnerability exploits the gap between user role assignment and command execution permissions within the database engine. When an attacker sends a bare ALTER TYPE edgeType WITH lightweight = true or similar modification request, the system fails to verify whether the requesting entity possesses the necessary UPDATE_SCHEMA rights before proceeding with the schema alteration. This allows for persistent changes to how edges are stored in the underlying storage layer. Lightweight edges typically consume less memory and offer faster traversal performance but may have limitations regarding property storage compared to standard edges. By forcing this change without proper authorization, an attacker can fundamentally alter the data model's behavior and constraints, potentially leading to unexpected system behaviors or bypassing application-level logic that relies on specific edge characteristics.
The operational impact of this vulnerability is significant as it compromises both integrity and availability aspects of database security. An unauthorized user can degrade performance by forcing lightweight storage which might not support certain property types required by the application, effectively causing data corruption or loss for properties stored on those edges. Furthermore, altering unique flags without permission can lead to duplicate entries where uniqueness was previously enforced, breaking referential integrity constraints that applications depend upon for correct functioning. This unauthorized schema modification undermines the principle of least privilege and allows low-privileged users to perform administrative tasks, which could be leveraged in conjunction with other vulnerabilities to achieve more severe outcomes such as data exfiltration or denial of service through structural instability.
This vulnerability aligns with CWE-269 Improper Privilege Management, where a user is granted privileges that exceed their intended role, and CWE-862 Missing Authorization, indicating the system failed to enforce access controls for schema modification operations. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1074 Data Staged or potentially T1562 Impair Defenses if used to disable security features, though primarily it reflects unauthorized privilege escalation within the application layer allowing structural changes that bypass intended restrictions. The ability to modify schema definitions remotely via standard APIs highlights a systemic issue in how command parsing and permission checks are decoupled from role-based access control lists.
To mitigate this risk, organizations running affected versions of ArcadeDB must upgrade immediately to version 26.10.1 or later where the authorization logic has been corrected to properly validate UPDATE_SCHEMA permissions before executing ALTER TYPE commands that modify edge properties. Until an upgrade is feasible, administrators should restrict network access to database ports and ensure that no read-only users are granted direct API access unless absolutely necessary for specific operational needs. Implementing strict firewall rules limiting inbound connections to trusted IP ranges can reduce the attack surface significantly. Additionally, auditing logs for ALTER TYPE commands executed by non-administrative accounts can help detect potential exploitation attempts in real-time while longer-term architectural reviews ensure that schema modification operations are always gated behind robust multi-factor authentication and explicit role-based access controls.