CVE-2026-114056: ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH

Q: Which deployments are affected?

ArcadeDB versions from 26.8.1 up to, but not including, 26.10.1 are affected. The exposed command interfaces are HTTP, gRPC, and Bolt.

Q: What access does an attacker need?

An attacker needs credentials for a read-only user and access to a supported command API. No user interaction is required, and the attacker does not need UPDATE_SCHEMA permission.

Q: What can an attacker change?

A read-only user can issue a bare ALTER TYPE edgeType WITH lightweight = true command to persistently modify lightweight and unique schema flags for an edge type. The impact is limited to integrity according to the supplied severity vector.

Q: How can I determine whether an instance is affected?

Check whether the ArcadeDB version is in the range from 26.8.1 before 26.10.1, and whether read-only users can reach the HTTP, gRPC, or Bolt command APIs. Review schema changes to edge types for unexpected modifications to lightweight or unique flags.

Published Oct 21, 2026

Updated

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATESCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.

Affected Software

1 affected component

ArcadeDB ArcadeDB>=26.8.1<26.10.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ArcadeDB to a version that resolves this vulnerability.
Fixed in 26.10.1

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ArcadeDB versions from 26.8.1 up to, but not including, 26.10.1 are affected. The exposed command interfaces are HTTP, gRPC, and Bolt.

What access does an attacker need?

An attacker needs credentials for a read-only user and access to a supported command API. No user interaction is required, and the attacker does not need UPDATE_SCHEMA permission.

What can an attacker change?

A read-only user can issue a bare ALTER TYPE edgeType WITH lightweight = true command to persistently modify lightweight and unique schema flags for an edge type. The impact is limited to integrity according to the supplied severity vector.

How can I determine whether an instance is affected?

Check whether the ArcadeDB version is in the range from 26.8.1 before 26.10.1, and whether read-only users can reach the HTTP, gRPC, or Bolt command APIs. Review schema changes to edge types for unexpected modifications to lightweight or unique flags.

CVE-2026-114056: ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What can an attacker change?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What can an attacker change?

How can I determine whether an instance is affected?