Live › vulnerability › CVE-2026-114056
Go to dashboardArcadeDB from 26.8.1 before 26.10.1 lets read-only users change edge type lightweight and unique schema flags without the UPDATE_SCHEMA permission. An attacker with read-only access can send a bare ALTER TYPE command over HTTP, gRPC or Bolt to persistently change how edge storage is declared.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running ArcadeDB between versions 26.8.1 and 26.10.1 where some users hold read-only rather than schema-update rights. Exposure depends on whether untrusted or low-privilege users can reach the command API over HTTP, gRPC or Bolt. Deployments that run only trusted users with full schema rights are less exposed.
No product ranges from the sources yet.
26.8.1 to before 26.10.126.10.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.
This page as .md · .json · in your agent: get_signal("CVE-2026-114056")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.