CVE-2026-119576
Deferred Deferred - Pending Action

Authorization Bypass in ArcadeDB via GraphQL Schema Manipulation

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119576
EUVD
EUVD-2026-113930

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ArcadeData arcadedb 21.12.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB versions from 21.12.1 to 26.10.1 have an authorization bypass flaw. Users with read-only access can replace the shared GraphQL schema by sending a crafted query with a @sql directive to the /api/v1/query/{database} endpoint. This allows altering query results for other users, including administrators.

Impact Analysis

Attackers could manipulate GraphQL queries to return false or malicious data to users. This could lead to unauthorized data exposure, incorrect query results, or potential privilege escalation if administrators are affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity, leading to compliance violations.

Mitigation Strategies

Upgrade ArcadeDB to version 26.10.2 or later to address the authorization bypass vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart