CVE-2026-54076
- Source
- https://cve.org/CVERecord?id=CVE-2026-54076
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54076.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-54076
- Aliases
- Published
- 2026-09-15T15:16:21Z
- Modified
- 2026-09-17T08:08:35Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
- Details
-
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-862", "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54076.json" }- References
-
- https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vg6x-6pg9-6qwg
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54076.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-54076
- https://github.com/ArcadeData/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614
- https://github.com/ArcadeData/arcadedb/pull/4423
Affected packages
Git / github.com/arcadedata/arcadedb
Affected versions
21.*
21.10.1
21.10.2
21.11.1
21.12.1
21.9.1
22.*
22.1.2
22.1.3
22.10.1
22.11.1
22.12.1
22.2.1
22.6.1
22.8.1
22.9.1
23.*
23.1.1
23.1.2
23.10.1
23.11.1
23.12.1
23.12.2
23.2.1
23.3.1
23.4.1
23.5.1
23.6.1
23.7.1
23.9.1
24.*
24.1.1
24.10.1
24.11.1
24.11.2
24.2.1
24.4.1
24.5.1
24.6.1
25.*
25.1.1
25.10.1
25.11.1
25.12.1
25.2.1
25.3.1
25.3.2
25.4.1
25.6.1
25.7.1
25.8.1
25.9.1
26.*
26.1.1
26.2.1
26.3.1
26.3.2
26.4.2
26.5.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54076.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"251625398118715968895439364564080268274",
"28946877285315698996013025800931407354",
"86677954592170503466613845002589721707",
"165132115412051532664292921481706454408",
"103284758792253392620113588452730619387",
"314128001418189075484154945283124598102",
"291373606870165446957349544878546093564",
"318814302440930978364112581875656640917",
"317010180379524496504042036746980736435",
"41578810093026584313998517742143336048",
"128700004319694026385747195199739063944",
"23115347272449021940217864255985532648",
"186404955911654576587864407965142199055",
"114035088019872527384688611325882628774",
"52313755133043494575422900460270701272",
"104600075166888228597082334557169174114",
"139368728709109319413994814303461091183",
"296677373330036724456141014801565492310",
"224460127010026128637625506995329963750",
"187018610450571238558375774333654473033",
"49029157111612895519500896652838295428",
"294820744629820018781994760746401842942",
"10337035676763724834542576222436498245",
"207910061544327326501552045140459004642",
"176115256469591477992196048328771902433",
"280857955284370636501857076617343138810",
"203044598570098551991039392586508096252",
"313260403812832570800529773307704062548",
"131294177965362672310433535860766910765",
"199064923376265862523441207001955228715",
"137965750299336502292607235080008703550",
"186120402418638787343429868573323844036",
"90065067263074615974466352160006688972",
"42084212722088708137243920291719826671",
"129209701096524184590209151291725307758",
"327080927796880165516401755016200999499",
"302941790066602351400227477436270042773",
"37457602345512170315435219829889405166",
"121606734815831486134624200042501074443",
"117726708628747106150044945516138758885",
"325978462277376183323614474353311255288",
"272527522139431097326043252794080899081",
"157092032249484855871707049556230635660",
"78622536829283660079571236787265201467",
"65902115951845664695256353223869570264",
"253959406529261240846519585245142187178",
"19713457104196597349086707517363985253",
"91033390212619836912432855492824889705",
"54451106589582139212028568629165841868",
"166210309424079220309375856563889083024",
"133779923687102166704676962452125019714",
"249312982967104172202433550527296186324"
],
"threshold": 0.9
},
"id": "CVE-2026-54076-074414e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "235914136390546005836469790530372013871",
"length": 514
},
"id": "CVE-2026-54076-08b3ccba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setMin"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "30255247197799747026974875706655645635",
"length": 294
},
"id": "CVE-2026-54076-1ab131a2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setCustomValue"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "332934922490247576575565465095670272599",
"length": 443
},
"id": "CVE-2026-54076-1b57f945",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "dropProperty"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "272563248695848701963571473278092793429",
"length": 723
},
"id": "CVE-2026-54076-212b5987",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "createProperty"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "190308484817962677091301764032069087117",
"length": 598
},
"id": "CVE-2026-54076-22dfdaa5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setCompression"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "98603398326291222625966297735443963241",
"length": 267
},
"id": "CVE-2026-54076-2806e7c5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "removeSuperType"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "188537419453289700823014365212182837150",
"length": 115
},
"id": "CVE-2026-54076-2c209da0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "removeBucket"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111529322115410252970401365916984738102",
"329148617438827924013816993060021361177",
"108743341754266329786827528920496809265",
"133681391463048349829061310106410049165",
"281016054862385109063184032947760495991",
"62178515991215105156806240778665403542",
"43458972259977408131469471273678078928",
"178376448550593311252283976015210896507",
"186189555660907192568169989731690812918",
"7136606254664839605964413336558696967",
"223305696685840809024522294621047701788",
"334069533703657228226470230260769855003",
"303878922146948635960183206930158668153",
"300277931555359923243345759461858117336",
"148678435388652605170789113229379329320",
"273694128741041008159932499301446431217",
"64704223848144959018635556146589296234",
"241236630647838875050171378868615491811",
"312472003889010869873441787282051370588",
"64035844190856061642570204927995937985",
"89085715290160169579045844130458790093",
"244466949159154066930361227726067655207",
"310996282410526250826108066136817767262",
"260699332945509384586381894323826766106",
"262818409667968946727800548669110186407",
"116259722860022697629020654201944019172",
"279190057247951840190529817462607129016",
"109240847570293634697700127822387504417",
"339307954667594289986194065211180199359",
"22495557727702120668732053166677603429",
"136293700513256441292251746323044257021",
"143375441506361377090465616308054495462",
"269048738333793950511955239471924508783",
"113767100318168382758214135145499317011",
"279121735493345474117460575386855301937",
"117161819138230716229124774163795905701",
"174698783048916935392357473933013320991",
"6180849882874330905876553686631017767",
"180718282687270787627997861374414401311"
],
"threshold": 0.9
},
"id": "CVE-2026-54076-3b342de2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120534516146808442714333916919177353824",
"length": 211
},
"id": "CVE-2026-54076-57cffd49",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setReadonly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "178252179611664862257183581125578818477",
"length": 578
},
"id": "CVE-2026-54076-72fa1f5f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setDefaultValue"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23525030896333640172492114746560827874",
"length": 424
},
"id": "CVE-2026-54076-7a390e04",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "setSuperTypes"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206103815031787750690684817870704700783",
"length": 1313
},
"id": "CVE-2026-54076-7bc9c9f6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "rename"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60834873082707962568100377592773320045",
"length": 2177
},
"id": "CVE-2026-54076-8c69a801",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "addSuperType"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120534516146808442714333916919177353824",
"length": 211
},
"id": "CVE-2026-54076-9bc161c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setRegexp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120534516146808442714333916919177353824",
"length": 211
},
"id": "CVE-2026-54076-adfcb930",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setHidden"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "62344817309230768174405865549105828413",
"length": 564
},
"id": "CVE-2026-54076-b48c5feb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "setAliases"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "49874459903957370123931547591923237454",
"length": 884
},
"id": "CVE-2026-54076-c07dc503",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setOfType"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "188537419453289700823014365212182837150",
"length": 115
},
"id": "CVE-2026-54076-c0cc110f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java",
"function": "addBucket"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120534516146808442714333916919177353824",
"length": 211
},
"id": "CVE-2026-54076-c354a389",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setNotNull"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "180533858145398956851762536030427726162",
"length": 514
},
"id": "CVE-2026-54076-d14f64c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setMax"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120534516146808442714333916919177353824",
"length": 211
},
"id": "CVE-2026-54076-d9fe7516",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setMandatory"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "102624918693198142192220722745622726635",
"length": 413
},
"id": "CVE-2026-54076-dd427cc0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614",
"target": {
"file": "engine/src/main/java/com/arcadedb/schema/LocalProperty.java",
"function": "setExternal"
}
}
]
vanir_signatures_modified
"2026-09-17T08:08:35Z"