ArcadeData ArcadeDB up to 26.6.0 Schema Mutators LocalDocumentType.java LocalDocumentType.createProperty privileges management

Summaryinfo

A vulnerability described as problematic has been identified in ArcadeData ArcadeDB up to 26.6.0. Impacted is the function LocalDocumentType.createProperty of the file engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java of the component Schema Mutators. Executing a manipulation can lead to privileges management. This vulnerability is tracked as CVE-2026-54076. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in ArcadeData ArcadeDB up to 26.6.0. It has been declared as problematic. This vulnerability affects the function LocalDocumentType.createProperty of the file engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java of the component Schema Mutators. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect integrity, and availability. CVE summarizes:

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-54076 since 06/11/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 26.6.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ArcadeData

Name

• ArcadeDB

Version

• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6.0

Website

• Product: https://github.com/ArcadeData/arcadedb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion