Authorization Vulnerability in ArcadeDB Multi-Model DBMS
CVE-2026-54076

8.1HIGH

Key Information:

Vendor

Arcadedata

Status
Arcadedb
Arcadedb-engine
Vendor
CVE Published:
15 September 2026

What is CVE-2026-54076?

ArcadeDB, a Multi-Model Database Management System, has a vulnerability where certain schema mutation operations can be executed by authenticated users lacking proper permissions. Specifically, prior to version 26.6.1, methods for altering properties and types remained unchecked for authorization, allowing a user with a read-only API token to execute harmful commands such as DROP PROPERTY and ALTER TYPE through HTTP endpoints. This could lead to unauthorized changes to the database schema, resulting in corrupted data integrity and breach of the intended permission model. The issue has been addressed in ArcadeDB version 26.6.1.

Affected Version(s)

arcadedb < 26.6.1

arcadedb-engine < 26.6.1

References

https://github.com/ArcadeData/arcadedb/security/advisorie...
x_refsource_CONFIRM
https://github.com/ArcadeData/arcadedb/pull/4423
x_refsource_MISC
https://github.com/ArcadeData/arcadedb/commit/2ee76fe442b...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.