CVE-2026-114056

Deferred Deferred - Pending Action

Authorization Bypass in ArcadeDB Edge Type Schema Flags

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114056

EUVD

EUVD-2026-107007

Affected Vendors & Products

Vendor	Product	Version / Range
ArcadeData	arcadedb	26.8.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-114056 is an authorization bypass in ArcadeDB versions 26.8.1 to 26.9.1. It allows read-only users to modify edge type schema properties like lightweight or unique flags without UPDATE_SCHEMA permission by sending a crafted ALTER TYPE command via HTTP, gRPC, or Bolt APIs. The change persists after server restarts.

Detection Guidance

Check ArcadeDB server logs for suspicious ALTER TYPE commands altering lightweight or unique flags. Monitor for unauthorized schema modifications by read-only users. Use network traffic analysis to detect HTTP, gRPC, or Bolt API calls containing ALTER TYPE statements with schema changes.

Impact Analysis

An attacker with read-only access could alter edge storage behavior, potentially affecting database performance or integrity. While it doesn't allow data access or type creation/dropping, persistent schema changes may disrupt operations relying on expected edge type properties.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized modifications to database schema properties. For GDPR, unauthorized changes to data storage structures may affect data integrity and access controls, potentially violating principles of lawful processing and security. For HIPAA, unauthorized schema alterations could compromise the confidentiality and integrity of protected health information by bypassing intended access restrictions.

Mitigation Strategies

Restrict UPDATE_SCHEMA permissions to authorized users only. Disable default-enabled command endpoints if possible. Upgrade to ArcadeDB 26.10.1 or later if available. Implement strict input validation for ALTER TYPE commands to prevent unauthorized schema modifications.

Hi! I’m here to help you understand CVE-2026-114056. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...