CVE-2026-114056Medium· 4.3▾ SunlitArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.
arcadedb >= 26.8.1 < 26.10.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114057Medium· 4.3ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
CVE-2026-114058Medium· 4.3ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
CVE-2026-93595Medium· 6.5ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints
CVE-2026-93596Medium· 4.3ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/{database}
CVE-2026-54076High· 8.1ArcadeDB is a Multi-Model DBMS
CVE-2026-114059High· 7.5ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization