Description
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.
Published: 2026-10-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Patch Now
AI Analysis

Impact

ArcadeDB versions prior to 26.10.1 contain an authorization bypass flaw that lets read‑only users run the ALTER TYPE command to set edge type lightweight and unique flags without needing UPDATE_SCHEMA privilege. This allows an attacker to persistently alter how edge data is stored, effectively changing schema behavior without proper authorization.

Affected Systems

All ArcadeData ArcadeDB deployments running 26.8.1 through 26.10.0 are affected. The fix is available in version 26.10.1 and later, and the vulnerability can be exercised via the HTTP, gRPC, or Bolt interfaces that the database exposes.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers could remotely trigger the bypass by issuing a bare ALTER TYPE command over any of the supported APIs, making it exploitable from external network positions.

Generated by OpenCVE AI on October 21, 2026 at 15:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to ArcadeDB 26.10.1 or later to apply the vendor patch
  • Restrict or disable ALTER TYPE capabilities for users without UPDATE_SCHEMA permission through role configuration
  • If immediate upgrade is not possible, block or limit external access to the HTTP, gRPC, and Bolt endpoints that accept unauthenticated schema modification commands

Generated by OpenCVE AI on October 21, 2026 at 15:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Arcadedata
Arcadedata arcadedb
Vendors & Products Arcadedata
Arcadedata arcadedb

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.
Title ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Arcadedata Arcadedb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-28T15:17:25.140Z

Reserved: 2026-10-20T21:42:27.670Z

Link: CVE-2026-114056

cve-icon Vulnrichment

Updated: 2026-10-28T15:17:20.779Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T01:17:28.507

Modified: 2026-10-28T16:17:04.150

Link: CVE-2026-114056

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:15:03Z

Weaknesses