Medium severity · published Oct 30, 2026
CVE-2026-119576
ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
New
4.3
CVSS
–
EPSS
No
On KEV
Description
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
arcadedb · ArcadeData
21.12.1 before 26.10.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119576
github.com
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-773f-9j7c-cr54
www.vulncheck.com
https://www.vulncheck.com/advisories/arcadedb-from-21.12.1-before-26.10.2-graphql-schema-replacement-via-read-only-query-endpoint
More from arcadedb
9.9
CVE-2026-75851
ArcadeDB before 26.8.1 Authentication Bypass via Async Command
9.9
CVE-2026-75843
ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
9.8
CVE-2026-75854
ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
9.8
CVE-2026-75852
ArcadeDB MongoDB wire protocol authentication bypass cross-database
9.8
CVE-2026-67341
ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION