Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54076— ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

Quick assessment

Affected
ArcadeData arcadedb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ArcadeDB 是一个多模型数据库管理系统（DBMS）。在 26.6.1 版本之前，针对 CVE-2026-44221 的修复仅在 方法中添加了 权限检查，而位于 和 中的其他公开模式修改（schema mutator）方法仍缺乏相应的权限校验。 因此，任何已认证的标识身份——包括仅有只读 API 令牌但未授予 权限的用户——均可通过数据库的命令/查询 HTTP 端点使用 、 或 等操作，执行以下未授权的模式变更：重命名类型、更改继承关系、修改别名或桶（buckets）、删除属性以及更改属性约束。 虽然此问题不会

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1079
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54076

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
Source: CVE Program / CVE List V5
Vulnerability Description
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ArcadeData arcadedb < 26.6.1 -
com.arcadedb arcadedb-engine < 26.6.1 -

II. Public POCs for CVE-2026-54076

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54076

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54076 (2)

Vendor Advisories for CVE-2026-54076 (1)

Vendor Pages for CVE-2026-54076 (1)

Same Patch Batch · ArcadeData · 2026-09-15 · 3 CVEs total

CVE-2026-65831 7.7 HIGH ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language —
CVE-2026-54077 7.1 HIGH ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

IV. Related Vulnerabilities

Same product: arcadedb
Same vendor: ArcadeData
Same weakness: CWE-862

V. Comments for CVE-2026-54076

No comments yet

Leave a comment