Incorrect Authorization Affecting com.arcadedb:arcadedb-engine package, versions [,26.6.1)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-COMARCADEDB-18021396
- published20 Jul 2026
- disclosed16 Jul 2026
- creditKai Aizen
Introduced: 16 Jul 2026
CVE-2026-54076 (opens in a new tab)How to fix?
Upgrade com.arcadedb:arcadedb-engine to version 26.6.1 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the LocalDocumentType and LocalProperty schema-mutator methods. An attacker can mutate their database schema by sending DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY requests with an authenticated identity that lacks UPDATE_SCHEMA, including a read-only API token. This lets the attacker rename types, change inheritance, and alter property constraints on the affected database, breaking the meaning of stored records and bypassing the documented schema-permission model.
Notes
LocalDocumentTypeandLocalPropertyare only reachable through the SQL DDL path; in server deployments that expose the HTTP command/query endpoints, a read-only API token can reach the vulnerable mutators even though it lacks schema-write permission.- The affected schema changes include type renames, supertype/alias/bucket changes, and property constraint/value metadata updates, so the impact is broader than just creating or dropping a property.
Workarounds
- Grant write access only to trusted users and API tokens; keep schema DDL (
DROP PROPERTY,ALTER TYPE,ALTER PROPERTY) available only to administrators until you can upgrade. This prevents a read-only or otherwise untrusted identity from mutating the schema over the database command/query HTTP endpoints.