Read the docs
TI-2026-83078 Aliases CVE-2026-119576GHSA-7ggx-x32v-fc5c

Authorization bypass in ArcadeDB lets users replace the GraphQL schema

Priority LOW 23CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass that lets users with only readRecord permission replace the shared GraphQL schema through the read-only query endpoint. An authenticated remote attacker with low privileges can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, which alters query results returned to other users, including administrators. The flaw is classified as CWE-862 (Missing Authorization).

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.

Why it matters now

EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed arcadedb (ArcadeData): 26.10.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArcadeDataarcadedb21.12.1 to before 26.10.226.10.2Patch availableCNA
  • arcadedb VendorArcadeData Affected 21.12.1 to before 26.10.2 Fixed in 26.10.2 Patch available CNA

Remediation

ArcadeDB users should upgrade to version 26.10.2, which fixes the issue. The sources list no other fixed version for arcadedb.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA arcadedb (ArcadeData) Fixed in 26.10.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ArcadeData arcadedb 26.10.2

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-83077 SSRF in ArcadeDB via ALTER DATABASE LOAD CSV block listPriority MEDIUM 64
    • TI-2026-83079 Improper session revocation in ArcadeDB wire-protocol connectionsPriority LOW 35
    Show all 3 records →

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119576
  2. 2026-10-30 Alias added: GHSA-7ggx-x32v-fc5c

References

Advisory 1

  • TI-2026-53098 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication CVSS 4.0CRITICAL 9.3
  • TI-2026-53086 ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex CVSS 4.0HIGH 8.7
  • TI-2026-53095 ArcadeDB before 26.8.1 Authentication Bypass via Async Command CVSS 4.0CRITICAL 9.4
  • TI-2026-53089 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction CVSS 4.0CRITICAL 9.4
  • TI-2026-53097 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database CVSS 4.0HIGH 8.7
  • TI-2026-63057 ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission CVSS 4.0HIGH 8.6
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences