CVE-2026-114056— ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
Quick assessment
Affected
ArcadeData arcadedb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ArcadeDB 26.8.1 至 26.10.1（不含）版本存在一个授权绕过漏洞，该漏洞允许只读用户在不具备 UPDATE_SCHEMA 权限的情况下，修改边类型（edge type）的 lightweight 和 unique 模式标志。攻击者可通过 HTTP、gRPC 或 Bolt 命令 API 发送裸命令 ，从而持久化地篡改边的存储声明。
Possible ATT&CK Techniques 3 AI
T1562 T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114056
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
Source: CVE Program / CVE List V5
Vulnerability Description
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ArcadeData | arcadedb | 26.8.1 ~ 26.10.1 | - |
|
II. Public POCs for CVE-2026-114056
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114056
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114056 (2)
Same Patch Batch · ArcadeData · 2026-10-21 · 4 CVEs total
| CVE-2026-114059 | 7.5 HIGH | ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization |
| CVE-2026-114058 | 4.3 MEDIUM | ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol |
| CVE-2026-114057 | 4.3 MEDIUM | ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure |
IV. Related Vulnerabilities
Same product: arcadedb
-
CVE-2026-114059
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missin -
CVE-2026-114058
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization vi -
CVE-2026-114057
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Informati -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same vendor: ArcadeData
-
CVE-2026-114059
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missin -
CVE-2026-114058
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization vi -
CVE-2026-114057
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Informati -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same weakness: CWE-862
-
CVE-2026-111849
WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control -
CVE-2026-114390
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114387
Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarde -
CVE-2026-114388
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114120
SchedulePress before 5.3.5 Missing Authorization via wpsp_el
V. Comments for CVE-2026-114056
No comments yet