ArcadeDB CVE-2026-119576

Requires a valid ArcadeDB account holding at least readRecord permission on the target database (PR:L - not remote-unauthenticated), the GraphQL module must be loaded and the /api/v1/query/{database} endpoint exposed to such users, and the request must use language: graphql carrying a GraphQL type definition with a crafted @sql directive. Affected versions are 21.12.1 up to and including 26.10.1. Impact is further gated and delayed: the altered shared schema only changes results once another user (e.g., an administrator) subsequently issues a GraphQL query, and the directive runs with the querying user's own privileges, so there is no data write or privilege escalation. The vendor's workaround is to upgrade to 26.10.2, or on earlier versions not to expose GraphQL to users who must not alter what others see, or to not load the GraphQL module.

All signals point to a genuine but moderate, authenticated-only issue rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, 5.3 Medium) shows network reach and low complexity but requires low privileges (PR:L) - an attacker must already hold a valid account with readRecord on the target database - and the only impact is low integrity (VI:L): no confidentiality loss, no availability loss, and no write/privilege escalation (the vendor explicitly states the @sql directive runs as the querying user). The GHSA advisory corroborates this: it is an integrity problem of the database's shared GraphQL schema, where a read-only user can change what other users (including administrators) see in query results. The vuln.today decision label is this_month (not act_now/emergency), consistent with the Medium rating. No CISA KEV listing is present and no EPSS score was provided in the input, so there is no signal of active or probable widespread exploitation; however, a detailed step-by-step Proof of Concept is published in the GHSA advisory, lowering the barrier to reproduction. Net: a real, patch-this-cycle authorization-bypass (CWE-862) affecting data integrity, meaningfully gated by the need for valid credentials and an exposed GraphQL module, and further limited by low real-world deployment of ArcadeDB. EPSS was not supplied, so exploitation probability cannot be quantified from the available data.

An attacker who has been granted a low-privilege ArcadeDB account with only readRecord permission sends a crafted GraphQL type definition containing an @sql directive to the read-only /api/v1/query/{database} endpoint (language: graphql); the server accepts it (HTTP 200) even though direct schema commands like CREATE DOCUMENT TYPE are refused with 403. When an administrator or other user next runs a GraphQL query, they silently receive attacker-controlled results instead of the real data. A detailed reproduction PoC is published in the GHSA advisory, though it is not provided as a verified working exploit tool.