CVE-2026-114056
CVE-2026-114056 · ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
This page contains facts from public vulnerability sources. Check the original advisory before updating.
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
arcadedb
- Versions
- ≥ 26.8.1, < 26.10.1: Affected (semver)
- 26.10.1: Not affected (semver)
Update to 26.10.1