ArcadeDB CVE-2026-54076

Requires an authenticated identity on the target ArcadeDB database - the CVSS vector's PR:L confirms low-privilege authentication is needed, and the description specifies this can be as little as a read-only API token that lacks UPDATE_SCHEMA. The attacker must be able to reach the database command/query HTTP endpoints and issue SQL DDL (DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY). What limits exploitation: a valid credential/token is required (not fully unauthenticated), the server's HTTP endpoints must be network-reachable to the attacker, and the deployment must be running client/server mode with non-admin users - embedded mode and internal system paths (startup schema load, HA replication) are unaffected because the check is a no-op there. No user interaction and no non-default configuration beyond issuing a token to an untrusted party is required.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) is internally consistent with the description: network-reachable HTTP endpoints, low complexity, and low privileges (any authenticated token) with no user interaction, yielding high integrity impact and no confidentiality impact. The one point worth scrutiny is the A:H rating - schema corruption plausibly degrades availability (a dropped property or renamed type can break application reads), but the description explicitly says it does not directly read or write record data, so A:H may be somewhat aggressive versus the demonstrated schema-integrity impact; I independently assess availability as Low rather than High. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation-probability signals are absent - treat this as an authorization/integrity issue whose severity rests on the CVSS integrity impact plus the low bar of needing only a read-only token, not on any evidence of active exploitation.

An attacker who has obtained any valid ArcadeDB credential or a read-only API token - for example a token issued to a reporting service - sends an SQL DDL statement such as DROP PROPERTY User.email or ALTER TYPE Account NAME LegacyAccount to the database command HTTP endpoint. The server executes it without checking UPDATE_SCHEMA, silently corrupting the schema so that stored records lose their meaning and dependent application logic breaks. No public exploit code is identified, but the attack requires only a single crafted HTTP request and low attacker skill given AC:L.