CVE-2026-119576

ArcadeDB versions 21.12.1 before 26.10.2 are vulnerable to an authorization bypass that allows users with minimal readRecord privileges to replace the shared GraphQL schema via a read-only query endpoint. By sending a GraphQL type definition containing a crafted @sql directive to the /api/v1/quer...

EUVD-2026-113930

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

CVE-2026-119576 ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...