What is the CVSS score of EUVD-2026-78785?

EUVD-2026-78785 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

Which versions of ArcadeDB are affected by EUVD-2026-78785?

ArcadeDB versions before 26.6.1 contain an authorization bypass that allows authenticated users with read-only API tokens to perform unauthorized schema modifications, enabling privilege escalation.. A patch is available.

How to fix or mitigate EUVD-2026-78785?

Within 24 hours, prioritize upgrade planning to ArcadeDB 26.6.1 across all production systems and identify all applications and API token holders connected to affected instances. Within 7 days, complete the patched deployment and audit database logs for schema changes since vulnerability disclosure to identify malicious mutations; verify that UPDATE_SCHEMA permission enforcement is now active on all schema-altering endpoints. Within 30 days, conduct comprehensive access control audit of all API tokens and database roles, document any anomalous schema operations, and implement monitoring and alerting for unauthorized schema mutation attempts.

ArcadeDB EUVD-2026-78785

| CVE-2026-54076 HIGH

Missing Authorization (CWE-862)

2026-07-16 https://github.com/ArcadeData/arcadedb

GHSA-vg6x-6pg9-6qwg

Authentication Bypass Java

8.1

CVSS 3.1 · Vendor: https://github.com/ArcadeData/arcadedb

Severity by source

Vendor (https://github.com/ArcadeData/arcadedb) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.1 HIGH

Network HTTP endpoint (AV:N), any authenticated token suffices (PR:L), no UI; schema tampering gives high integrity impact but no data disclosure (C:N) and only partial availability degradation (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/ArcadeData/arcadedb).

CVSS VectorVendor: https://github.com/ArcadeData/arcadedb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 20:34 vuln.today

Analysis Generated

Jul 16, 2026 - 20:34 vuln.today

CVE Published

Jul 16, 2026 - 20:08 github-advisory

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 maven packages depend on com.arcadedb:arcadedb-engine (8 direct, 8 indirect)

Ecosystem-wide dependent count for version 26.6.1.

DescriptionCVE.org

Impact

The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an UPDATE_SCHEMA authorization check to a single schema-mutating method (LocalDocumentType.createProperty). The remaining public schema mutators were left unchecked, so an authenticated identity (including a read-only API token) that lacks the UPDATE_SCHEMA permission could still mutate the database schema on its own database:

DROP PROPERTY <type>.<property>
ALTER TYPE <name> SUPERTYPE +<other> / -<other> (change the inheritance hierarchy)
ALTER TYPE <name> NAME <newName> (rename a type)
type alias and bucket changes
ALTER PROPERTY <type>.<property> ... (MANDATORY, READONLY, NOTNULL, MIN, MAX, REGEXP, DEFAULT, OF, CUSTOM) - the LocalProperty setters had no check at all

This does not directly disclose or write record data, but it corrupts the meaning of every stored record and breaches the documented permission model, which advertises UPDATE_SCHEMA as the gating right for schema mutation.

Affected component

Engine schema layer: engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java, reachable via the SQL DROP PROPERTY, ALTER TYPE, and ALTER PROPERTY statements over the database command/query HTTP endpoints.

Patches

Every public schema-mutating method on LocalDocumentType and LocalProperty now enforces checkPermissionsOnDatabase(UPDATE_SCHEMA) via a shared helper. The check is a no-op in embedded mode and in system contexts with no bound user (schema load at startup, HA replication apply), so internal paths and administrators are unaffected.

Workarounds

Grant write access only to trusted users and API tokens; treat all schema DDL as administrator-only at the application layer until upgraded.

Resources

Incomplete-fix sibling of CVE-2026-44221 / GHSA-fxc7-fm93-6q77.

Credit

Reported by Kai Aizen (SnailSploit).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 17, 2026

AnalysisAI

Missing-authorization schema tampering in ArcadeDB before 26.6.1 lets any authenticated identity - including a read-only API token that lacks the UPDATE_SCHEMA permission - mutate the database schema over the HTTP command/query endpoints. Because CVE-2026-44221's fix only added the UPDATE_SCHEMA check to LocalDocumentType.createProperty, the remaining schema mutators (DROP PROPERTY, ALTER TYPE, ALTER PROPERTY, type/bucket/alias changes) stayed unguarded, so a low-privilege user can drop properties, rename or re-parent types, and flip property constraints, corrupting the meaning of every stored record. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the vendor advisory (GHSA-vg6x-6pg9-6qwg) confirms the flaw and a fix in 26.6.1.

Technical ContextAI

ArcadeDB is a multi-model (document/graph/key-value) Java database that exposes SQL-style DDL over HTTP command/query endpoints and enforces per-database rights such as UPDATE_SCHEMA. The root cause is CWE-862 (Missing Authorization): the schema layer in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and LocalProperty.java implemented the UPDATE_SCHEMA permission check on only one of many public schema-mutating methods. LocalProperty's setters had no check at all, so operations reachable via DROP PROPERTY, ALTER TYPE (SUPERTYPE/NAME/alias/bucket), and ALTER PROPERTY (MANDATORY, READONLY, NOTNULL, MIN, MAX, REGEXP, DEFAULT, OF, CUSTOM) executed regardless of the caller's rights. This is an incomplete-fix sibling of CVE-2026-44221; the affected package is the Maven artifact pkg:maven/com.arcadedb:arcadedb-engine.

RemediationAI

Vendor-released patch: 26.6.1 - upgrade ArcadeDB (arcadedb-engine) to 26.6.1 or later, where every public schema-mutating method on LocalDocumentType and LocalProperty now enforces checkPermissionsOnDatabase(UPDATE_SCHEMA) via a shared helper (the check is a no-op in embedded mode and for system contexts with no bound user, so schema-load-at-startup, HA replication, and administrators are unaffected). Until you can upgrade, apply the vendor workaround: grant write access only to trusted users and API tokens and treat all schema DDL (DROP PROPERTY, ALTER TYPE, ALTER PROPERTY) as administrator-only at the application layer - the trade-off is that any legitimate low-privilege workflow relying on schema changes must be re-mediated through an admin path, and read-only tokens should be audited and reissued since they currently carry unintended schema-mutation power. Advisory: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vg6x-6pg9-6qwg.