CVE-2026-114056 ArcadeData CVE debrief

Who should care

Defenders and administrators of ArcadeDB instances should assess exposure and prioritize remediation. This includes reviewing and updating ArcadeDB versions, restricting ALTER TYPE WITH commands to authorized users, and monitoring for unauthorized schema changes. Additionally, security teams and vulnerability management teams should be aware of the potential risks and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-114056 is a medium-severity authorization bypass vulnerability in ArcadeDB versions 26.8.1 to 26.10.1. Defenders and administrators should assess exposure, prioritize remediation, and monitor for unauthorized schema changes.

• Potential unauthorized schema changes
• Read-only user exploitation for data tampering
• Schema flag modifications without proper authorization
• Possible data integrity issues

Technical summary

ArcadeDB versions 26.8.1 to 26.10.1 contain an authorization bypass vulnerability allowing read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. This vulnerability can be exploited by sending a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations. The vulnerability has a medium severity and defenders should prioritize remediation to prevent potential unauthorized schema changes and data integrity issues.

Defensive priority

Medium priority for read-only user authorization bypass vulnerability

Recommended defensive actions

• Review and update ArcadeDB versions to 26.10.1 or later
• Restrict ALTER TYPE WITH commands to authorized users
• Monitor for unauthorized schema changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Official CVE Program record and NVD vulnerability detail page provide information on authorization bypass vulnerability in ArcadeDB versions 26.8.1 to 26.10.1. The CVE Program record and NVD detail page confirm the vulnerability's existence and provide source-provided CVE metadata. However, the records have limitations and defenders should verify the information with the vendor and other sources to ensure accuracy.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.