{"id":"CVE-2026-54076","summary":"ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)","details":"ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.","aliases":["GHSA-vg6x-6pg9-6qwg"],"modified":"2026-09-17T08:08:35.842385Z","published":"2026-09-15T15:16:21.964Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862","CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54076.json"},"references":[{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"},{"type":"ADVISORY","url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vg6x-6pg9-6qwg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54076.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54076"},{"type":"FIX","url":"https://github.com/ArcadeData/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614"},{"type":"FIX","url":"https://github.com/ArcadeData/arcadedb/pull/4423"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/arcadedata/arcadedb","events":[{"introduced":"0"},{"fixed":"2ee76fe442b974b2482f1e9eddd1ab429bcac614"},{"fixed":"8cd72b1469113fc998101a29680fc2ef5d699b6e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"26.6.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["26.5.1","26.4.2","26.3.2","26.3.1","26.2.1","26.1.1","25.12.1","25.11.1","25.10.1","25.9.1","25.8.1","25.7.1","25.6.1","25.4.1","25.3.2","25.3.1","25.2.1","25.1.1","24.11.2","24.11.1","24.10.1","24.6.1","24.5.1","24.4.1","24.2.1","24.1.1","23.12.2","23.12.1","23.11.1","23.10.1","23.9.1","23.7.1","23.6.1","23.5.1","23.4.1","23.3.1","23.2.1","23.1.2","23.1.1","22.12.1","22.11.1","22.10.1","22.9.1","22.8.1","22.6.1","22.2.1","22.1.3","22.1.2","21.12.1","21.11.1","21.10.2","21.10.1","21.9.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54076.json","vanir_signatures_modified":"2026-09-17T08:08:35Z","vanir_signatures":[{"target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java"},"deprecated":false,"digest":{"line_hashes":["251625398118715968895439364564080268274","28946877285315698996013025800931407354","86677954592170503466613845002589721707","165132115412051532664292921481706454408","103284758792253392620113588452730619387","314128001418189075484154945283124598102","291373606870165446957349544878546093564","318814302440930978364112581875656640917","317010180379524496504042036746980736435","41578810093026584313998517742143336048","128700004319694026385747195199739063944","23115347272449021940217864255985532648","186404955911654576587864407965142199055","114035088019872527384688611325882628774","52313755133043494575422900460270701272","104600075166888228597082334557169174114","139368728709109319413994814303461091183","296677373330036724456141014801565492310","224460127010026128637625506995329963750","187018610450571238558375774333654473033","49029157111612895519500896652838295428","294820744629820018781994760746401842942","10337035676763724834542576222436498245","207910061544327326501552045140459004642","176115256469591477992196048328771902433","280857955284370636501857076617343138810","203044598570098551991039392586508096252","313260403812832570800529773307704062548","131294177965362672310433535860766910765","199064923376265862523441207001955228715","137965750299336502292607235080008703550","186120402418638787343429868573323844036","90065067263074615974466352160006688972","42084212722088708137243920291719826671","129209701096524184590209151291725307758","327080927796880165516401755016200999499","302941790066602351400227477436270042773","37457602345512170315435219829889405166","121606734815831486134624200042501074443","117726708628747106150044945516138758885","325978462277376183323614474353311255288","272527522139431097326043252794080899081","157092032249484855871707049556230635660","78622536829283660079571236787265201467","65902115951845664695256353223869570264","253959406529261240846519585245142187178","19713457104196597349086707517363985253","91033390212619836912432855492824889705","54451106589582139212028568629165841868","166210309424079220309375856563889083024","133779923687102166704676962452125019714","249312982967104172202433550527296186324"],"threshold":0.9},"id":"CVE-2026-54076-074414e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614"},{"source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setMin"},"deprecated":false,"digest":{"function_hash":"235914136390546005836469790530372013871","length":514},"id":"CVE-2026-54076-08b3ccba","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"30255247197799747026974875706655645635","length":294},"id":"CVE-2026-54076-1ab131a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"function":"setCustomValue","file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java"}},{"id":"CVE-2026-54076-1b57f945","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"dropProperty"},"deprecated":false,"digest":{"function_hash":"332934922490247576575565465095670272599","length":443}},{"id":"CVE-2026-54076-212b5987","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"createProperty"},"deprecated":false,"digest":{"length":723,"function_hash":"272563248695848701963571473278092793429"}},{"target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setCompression"},"deprecated":false,"digest":{"function_hash":"190308484817962677091301764032069087117","length":598},"id":"CVE-2026-54076-22dfdaa5","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"removeSuperType"},"deprecated":false,"digest":{"function_hash":"98603398326291222625966297735443963241","length":267},"id":"CVE-2026-54076-2806e7c5"},{"digest":{"function_hash":"188537419453289700823014365212182837150","length":115},"id":"CVE-2026-54076-2c209da0","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"function":"removeBucket","file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java"},"deprecated":false,"digest":{"line_hashes":["111529322115410252970401365916984738102","329148617438827924013816993060021361177","108743341754266329786827528920496809265","133681391463048349829061310106410049165","281016054862385109063184032947760495991","62178515991215105156806240778665403542","43458972259977408131469471273678078928","178376448550593311252283976015210896507","186189555660907192568169989731690812918","7136606254664839605964413336558696967","223305696685840809024522294621047701788","334069533703657228226470230260769855003","303878922146948635960183206930158668153","300277931555359923243345759461858117336","148678435388652605170789113229379329320","273694128741041008159932499301446431217","64704223848144959018635556146589296234","241236630647838875050171378868615491811","312472003889010869873441787282051370588","64035844190856061642570204927995937985","89085715290160169579045844130458790093","244466949159154066930361227726067655207","310996282410526250826108066136817767262","260699332945509384586381894323826766106","262818409667968946727800548669110186407","116259722860022697629020654201944019172","279190057247951840190529817462607129016","109240847570293634697700127822387504417","339307954667594289986194065211180199359","22495557727702120668732053166677603429","136293700513256441292251746323044257021","143375441506361377090465616308054495462","269048738333793950511955239471924508783","113767100318168382758214135145499317011","279121735493345474117460575386855301937","117161819138230716229124774163795905701","174698783048916935392357473933013320991","6180849882874330905876553686631017767","180718282687270787627997861374414401311"],"threshold":0.9},"id":"CVE-2026-54076-3b342de2","signature_type":"Line"},{"source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setReadonly"},"deprecated":false,"digest":{"length":211,"function_hash":"120534516146808442714333916919177353824"},"id":"CVE-2026-54076-57cffd49","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"178252179611664862257183581125578818477","length":578},"id":"CVE-2026-54076-72fa1f5f","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"function":"setDefaultValue","file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"setSuperTypes"},"deprecated":false,"digest":{"function_hash":"23525030896333640172492114746560827874","length":424},"id":"CVE-2026-54076-7a390e04"},{"deprecated":false,"digest":{"function_hash":"206103815031787750690684817870704700783","length":1313},"id":"CVE-2026-54076-7bc9c9f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"rename"}},{"deprecated":false,"digest":{"function_hash":"60834873082707962568100377592773320045","length":2177},"id":"CVE-2026-54076-8c69a801","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"addSuperType"}},{"signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"function":"setRegexp","file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java"},"deprecated":false,"digest":{"function_hash":"120534516146808442714333916919177353824","length":211},"id":"CVE-2026-54076-9bc161c3","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setHidden"},"deprecated":false,"digest":{"function_hash":"120534516146808442714333916919177353824","length":211},"id":"CVE-2026-54076-adfcb930"},{"deprecated":false,"digest":{"function_hash":"62344817309230768174405865549105828413","length":564},"id":"CVE-2026-54076-b48c5feb","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"setAliases"}},{"deprecated":false,"digest":{"function_hash":"49874459903957370123931547591923237454","length":884},"id":"CVE-2026-54076-c07dc503","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setOfType"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java","function":"addBucket"},"deprecated":false,"digest":{"function_hash":"188537419453289700823014365212182837150","length":115},"id":"CVE-2026-54076-c0cc110f"},{"signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setNotNull"},"deprecated":false,"digest":{"function_hash":"120534516146808442714333916919177353824","length":211},"id":"CVE-2026-54076-c354a389","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"180533858145398956851762536030427726162","length":514},"id":"CVE-2026-54076-d14f64c3","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setMax"}},{"digest":{"function_hash":"120534516146808442714333916919177353824","length":211},"id":"CVE-2026-54076-d9fe7516","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setMandatory"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"102624918693198142192220722745622726635","length":413},"id":"CVE-2026-54076-dd427cc0","signature_type":"Function","signature_version":"v1","source":"https://github.com/arcadedata/arcadedb/commit/2ee76fe442b974b2482f1e9eddd1ab429bcac614","target":{"file":"engine/src/main/java/com/arcadedb/schema/LocalProperty.java","function":"setExternal"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}]}