8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54076

CVE-2026-54076: ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

Impact

The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an UPDATE_SCHEMA authorization check to a single schema-mutating method (LocalDocumentType.createProperty). The remaining public schema mutators were left unchecked, so an authenticated identity (including a read-only API token) that lacks the UPDATE_SCHEMA permission could still mutate the database schema on its own database:

DROP PROPERTY <type>.<property>
ALTER TYPE <name> SUPERTYPE +<other> / -<other> (change the inheritance hierarchy)
ALTER TYPE <name> NAME <newName> (rename a type)
type alias and bucket changes
ALTER PROPERTY <type>.<property> ... (MANDATORY, READONLY, NOTNULL, MIN, MAX, REGEXP, DEFAULT, OF, CUSTOM) — the LocalProperty setters had no check at all

This does not directly disclose or write record data, but it corrupts the meaning of every stored record and breaches the documented permission model, which advertises UPDATE_SCHEMA as the gating right for schema mutation.

Affected component

Engine schema layer: engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java, reachable via the SQL DROP PROPERTY, ALTER TYPE, and ALTER PROPERTY statements over the database command/query HTTP endpoints.

Patches

Every public schema-mutating method on LocalDocumentType and LocalProperty now enforces checkPermissionsOnDatabase(UPDATE_SCHEMA) via a shared helper. The check is a no-op in embedded mode and in system contexts with no bound user (schema load at startup, HA replication apply), so internal paths and administrators are unaffected.

Workarounds

Grant write access only to trusted users and API tokens; treat all schema DDL as administrator-only at the application layer until upgraded.

Resources

Incomplete-fix sibling of CVE-2026-44221 / GHSA-fxc7-fm93-6q77.

Credit

Reported by Kai Aizen (SnailSploit).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54076

CVE-2026-54076:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.arcadedb:arcadedb-engine	maven	< 26.6.1	26.6.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because multiple methods in com.arcadedb.schema.LocalDocumentType and com.arcadedb.schema.LocalProperty that modify the database schema did not enforce the necessary UPDATE_SCHEMA permission. The previous fix for a related CVE was incomplete, only patching one method (createProperty). This allowed an authenticated user with only read permissions (such as via a read-only API token) to execute schema-altering operations like dropping properties, altering types, and changing property constraints. The patch for this vulnerability introduces a checkForSchemaMutation() helper method that centralizes the permission check and applies it to all public schema-mutating methods in both affected classes, effectively closing the authorization gap.

Vulnerable functions

com.arcadedb.schema.LocalDocumentType.removeSuperType

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to remove a supertype from a document type, thus modifying the database schema.

com.arcadedb.schema.LocalDocumentType.rename

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to rename a document type, thus modifying the database schema.

com.arcadedb.schema.LocalDocumentType.setSuperTypes

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to set the supertypes for a document type, thus modifying the database schema.

com.arcadedb.schema.LocalDocumentType.setAliases

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to set aliases for a document type, thus modifying the database schema.

com.arcadedb.schema.LocalDocumentType.dropProperty

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to drop a property from a document type, thus modifying the database schema.

com.arcadedb.schema.LocalDocumentType.addBucket

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to add a bucket to a document type, thus modifying the database schema.

com.arcadedb.schema.LocalDocumentType.removeBucket

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to remove a bucket from a document type, thus modifying the database schema.

com.arcadedb.schema.LocalDocumentType.addSuperType

engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java

This function was missing an authorization check, allowing a user with read-only permissions to add a supertype to a document type, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setDefaultValue

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the default value of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setOfType

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'of-type' for a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setReadonly

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'readonly' attribute of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setMandatory

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'mandatory' attribute of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setNotNull

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'notNull' attribute of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setHidden

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'hidden' attribute of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setExternal

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'external' attribute of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setCompression

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the compression of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setMax

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'max' constraint of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setMin

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'min' constraint of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setRegexp

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set the 'regexp' constraint of a property, thus modifying the database schema.

com.arcadedb.schema.LocalProperty.setCustomValue

engine/src/main/java/com/arcadedb/schema/LocalProperty.java

This function was missing an authorization check, allowing a user with read-only permissions to set a custom value on a property, thus modifying the database schema.