EUVD-2026-51807
GHSA-qwhj-f36r-39x7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
HTTP endpoint enables network exploitation; read-only credential is sufficient (PR:L); primary impact is schema integrity corruption and availability disruption, with minor confidentiality exposure from schema metadata.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access (e.g., a read-only API token) can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundary and potentially corrupting schema metadata and record routing.
AnalysisAI
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation SQL operations that should require the UPDATE_SCHEMA permission. A user holding only a read-only API token can submit ALTER TYPE ... CUSTOM or ALTER TYPE ... BUCKETSELECTIONSTRATEGY statements to the HTTP command endpoint, invoking setCustomValue and setBucketSelectionStrategy on LocalDocumentType without any permission enforcement. The consequence is unauthorized corruption of schema metadata and bucket-selection strategy, potentially disrupting record routing and data integrity across the database. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; a vendor-released patch is available in version 26.7.2.
Technical ContextAI
ArcadeDB is a multi-model database engine supporting graph, document, key-value, and time-series data models, identified by CPE cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*. The vulnerability's root cause is CWE-862 (Missing Authorization): the ALTER TYPE SQL surface - specifically the CUSTOM and BUCKETSELECTIONSTRATEGY clauses - maps internally to setCustomValue and setBucketSelectionStrategy on the LocalDocumentType class, but neither operation validates that the requesting principal holds the documented UPDATE_SCHEMA database permission before executing. The HTTP command endpoint, through which clients submit SQL to the database engine, is the delivery path. Because authorization is checked for some schema operations but not these two specific ones, the permission model has an inconsistent enforcement gap rather than a complete access-control bypass.
RemediationAI
Upgrade ArcadeDB to version 26.7.2 or later, which restores enforcement of the UPDATE_SCHEMA permission on ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY operations. The vendor patch is confirmed available via the GitHub Security Advisory GHSA-8vr5-263f-x5r3 (https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8vr5-263f-x5r3) and documented by VulnCheck at https://www.vulncheck.com/advisories/arcadedb-before-authentication-bypass-via-alter-type. If an immediate upgrade is not feasible, restrict network-level access to the HTTP command endpoint to only fully privileged, trusted principals - for example via firewall rules or an API gateway policy - accepting the trade-off of eliminating read-only API access for affected clients. As a post-incident step, audit existing schema definitions for unauthorized modifications to CUSTOM values or BUCKETSELECTIONSTRATEGY settings before applying the patch, since corrupted routing state may persist after upgrade.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today