CVE-2026-114056

Medium

Description

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.

SeverityMedium

CVSS4.3

Exploit probability—

ProductArcadedata Arcadedb

PublishedOct 21, 2026

First seenOct 21, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

ArcadeData arcadedb26.10.1 or later

Vendor advisories

github.com/ArcadeData/arcadedb/security/advisories/GHSA-9c7g-grf7-j2r5

Affected products

Product	Affected versions	Fixed in
ArcadeData arcadedb	26.8.1 ≤ v < 26.10.1	26.10.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.