CVE-2026-54076
Received Received - Intake

Insufficient Authorization Check in ArcadeDB Schema Mutators

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54076
EUVD
EUVD-2026-78785

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
arcadedb arcadedb to 26.6.1 (exc)
arcadedb arcadedb 26.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in ArcadeDB where non-admin users could perform schema modification operations without the required UPDATE_SCHEMA permission. While a previous fix added checks to one method, other schema-mutating methods remained unprotected. This allows authenticated users, including those with read-only tokens, to execute commands like DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY, corrupting the database schema and violating the documented permission model.

Detection Guidance

To detect unauthorized schema mutations, monitor HTTP endpoints for DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY commands. Check server logs for suspicious schema changes or failed UPDATE_SCHEMA permission attempts. Use ArcadeDB's audit logs if enabled to track schema modification operations.

Impact Analysis

Unauthorized schema changes can corrupt the meaning of stored records, disrupt database operations, and lead to data integrity issues. Attackers could rename types, drop properties, or alter constraints, potentially causing system failures or unintended data behavior. While record data isn't directly exposed, the schema corruption affects all stored records and violates expected access controls.

Compliance Impact

This vulnerability likely violates compliance requirements that mandate strict access controls and data integrity protections. Unauthorized schema modifications could lead to unauthorized data access, integrity breaches, or failure to maintain documented permission models, which are critical for GDPR and HIPAA compliance.

Mitigation Strategies

Upgrade to ArcadeDB version 26.6.1 or later. Restrict write access to trusted users only. Treat all schema DDL operations as administrator-only until upgrading. Review and revoke any read-only API tokens with unnecessary privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54076. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart