ArcadeDB CVE-2026-114056

Exploitation requires an authenticated ArcadeDB account with at least read-only privileges (CVSS PR:L); it is NOT remote-unauthenticated. The attacker must reach one of the exposed command APIs - HTTP, gRPC, or Bolt - which limits exposure where those interfaces are network-restricted. The specific trigger is a 'bare' ALTER TYPE edgeType WITH lightweight = true (or unique) command against an edge type; the flaw is that this schema-flag modification does not enforce the UPDATE_SCHEMA permission. Impact is limited to persistently altering edge-type lightweight/unique storage declarations - no data read, deletion, or service disruption is described. The principal limiting factor is the credential requirement; the principal aggravating factor is that no special non-default configuration is needed, so any deployment in the affected version range with low-privileged users reachable over these APIs is exposed.

This is a genuine but low-to-moderate priority issue, not a high-CVSS alarm. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 score are internally consistent with the description: a network-reachable, low-complexity action requiring only an authenticated low-privileged (read-only) account, with impact limited to integrity (VI:L) and no confidentiality or availability loss. The vendor/NVD vector contains no CVSS 3.1 equivalent in the input, and no EPSS score, KEV listing, or POC reference was supplied, so the exploitation-likelihood signals are absent rather than reassuringly low. Per the data provided there is no public exploit identified at time of analysis and the CVE is not in CISA KEV. The real-world risk is bounded by two factors the data makes clear: an attacker must already hold valid (even if read-only) credentials, and the damage is confined to persistently flipping edge-type 'lightweight' and 'unique' schema flags rather than reading data or taking down the service. The main caveat is that integrity impact on database storage declarations can be more consequential than VI:L suggests if flipping lightweight storage affects edge data retention or query correctness - verify the operational blast radius with the ArcadeData advisory (GHSA-9c7g-grf7-j2r5).

An attacker who has obtained or been granted a low-privilege, read-only ArcadeDB account connects to the database's HTTP, gRPC, or Bolt command API and issues a bare 'ALTER TYPE edgeType WITH lightweight = true' command. Because the schema-flag change is not gated by the UPDATE_SCHEMA permission, the command succeeds and persistently alters the edge storage declaration despite the user lacking schema-modification rights. No public exploit code is identified at time of analysis, but the command is trivial to reproduce from the description alone.