CVE-2026-54076: ArcadeDB Privilege Escalation Vulnerability

CVE-2026-54076 Overview

CVE-2026-54076 is a missing authorization vulnerability [CWE-862] in ArcadeDB, a multi-model database management system. The incomplete fix for CVE-2026-44221 added an UPDATE_SCHEMA check only to LocalDocumentType.createProperty, leaving other public schema mutators in LocalDocumentType.java and LocalProperty.java unprotected. An authenticated user, including a read-only API token holder without UPDATE_SCHEMA permission, can invoke DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the HTTP command and query endpoints. This allows attackers to rename types, change inheritance, alter buckets, drop properties, and modify constraints. The issue is fixed in version 26.6.1.

Critical Impact
Any authenticated identity, including read-only tokens, can mutate the database schema without the required UPDATE_SCHEMA permission, corrupting the semantic integrity of stored records.

Affected Products

ArcadeDB versions prior to 26.6.1
ArcadeDB HTTP command and query endpoints
Deployments relying on the documented UPDATE_SCHEMA permission boundary

Discovery Timeline

2026-09-15 - CVE-2026-54076 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-54076

Vulnerability Analysis

ArcadeDB enforces a permission model in which schema-altering operations require the UPDATE_SCHEMA capability. The prior remediation for CVE-2026-44221 added this check to a single entry point, LocalDocumentType.createProperty. Other schema-mutating methods in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java retained no authorization enforcement.

An authenticated caller can therefore submit SQL statements such as DROP PROPERTY, ALTER TYPE, and ALTER PROPERTY through the HTTP command or query endpoints. The database executes these statements even when the caller holds a read-only API token. While the flaw does not directly expose or overwrite record contents, unauthorized schema changes can invalidate application invariants and corrupt the interpretation of stored data.

Root Cause

The root cause is an incomplete authorization control [CWE-862]. Schema mutation logic was refactored to expose multiple public methods, but only one path invoked the permission check. Renaming types, changing inheritance, altering aliases or buckets, dropping properties, and changing property constraints all bypass the intended access control model.

Attack Vector

Exploitation requires network access to ArcadeDB HTTP endpoints and any valid authenticated credential. An attacker sends a schema-mutating SQL command through the database command or query API. No user interaction or elevated privileges are required beyond basic authentication, which makes shared read-only tokens a viable exploitation path.

java

// Patch: engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java
// Adds enforcement of UPDATE_SCHEMA on all schema mutators (#4423)

    return set;
  }

+  /**
+   * Enforces the UPDATE_SCHEMA permission for any schema-mutating operation. No-op in embedded mode or when no
+   * current user is bound to the thread (e.g. schema load at startup, replication apply).
+   */
+  protected void checkForSchemaMutation() {
+    ((DatabaseInternal) schema.getDatabase()).checkPermissionsOnDatabase(SecurityDatabaseUser.DATABASE_ACCESS.UPDATE_SCHEMA);
+  }
+
  @Override
  public DocumentType addSuperType(final String superName) {
    return addSuperType(schema.getType(superName));

Source: ArcadeDB commit 2ee76fe

java

// Patch: engine/src/main/java/com/arcadedb/schema/LocalProperty.java
// Imports required to invoke the shared permission check

 package com.arcadedb.schema;

 import com.arcadedb.database.Database;
+import com.arcadedb.database.DatabaseInternal;
 import com.arcadedb.exception.SchemaException;
+import com.arcadedb.security.SecurityDatabaseUser;

 import java.util.*;

Source: ArcadeDB commit 2ee76fe

Detection Methods for CVE-2026-54076

Indicators of Compromise

HTTP requests to /api/v1/command/* or /api/v1/query/* endpoints containing DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY statements from accounts lacking UPDATE_SCHEMA.
Unexpected schema version changes, renamed types, or altered inheritance relationships in ArcadeDB metadata.
Successful schema-mutating operations initiated by API tokens documented as read-only.

Detection Strategies

Enable request logging on ArcadeDB HTTP endpoints and alert on schema DDL keywords issued by low-privilege identities.
Baseline the schema and periodically diff type, bucket, and property definitions to detect unauthorized drift.
Correlate authentication logs with schema modification events to identify actors performing unexpected DDL.

Monitoring Recommendations

Forward ArcadeDB access and audit logs to a centralized analytics platform for retention and correlation.
Track failed and successful schema operations by user, token identifier, and source IP address.
Alert on schema mutation frequency deviations that exceed established application baselines.

How to Mitigate CVE-2026-54076

Immediate Actions Required

Upgrade ArcadeDB to version 26.6.1 or later, which enforces UPDATE_SCHEMA across all schema mutators.
Rotate all API tokens and database credentials after upgrading, particularly read-only tokens that may have been abused.
Audit the current schema against a known-good version and restore any unauthorized modifications.

Patch Information

The fix is released in ArcadeDB 26.6.1 and delivered through Pull Request #4423. The patch introduces checkForSchemaMutation() in LocalDocumentType and applies the UPDATE_SCHEMA check across every public schema-mutating method in LocalDocumentType.java and LocalProperty.java. Additional context is available in GitHub Security Advisory GHSA-vg6x-6pg9-6qwg.

Workarounds

Restrict network access to ArcadeDB HTTP endpoints so that only trusted clients and administrators can reach /api/v1/command and /api/v1/query.
Revoke or scope down authenticated identities that do not require schema access until the upgrade is complete.
Place a reverse proxy or web application firewall in front of ArcadeDB to block DDL keywords in requests from restricted users.

bash

# Verify installed ArcadeDB version and upgrade to the patched release
curl -s http://<arcadedb-host>:2480/api/v1/server | grep -i version

# Download and deploy ArcadeDB 26.6.1
wget https://github.com/ArcadeData/arcadedb/releases/download/26.6.1/arcadedb-26.6.1.tar.gz
tar -xzf arcadedb-26.6.1.tar.gz

# Restart the service after replacing binaries
./bin/server.sh stop && ./bin/server.sh start