CVE-2026-119576

ArcadeDB versions 21.12.1 before 26.10.2 are vulnerable to an authorization bypass that allows users with minimal readRecord privileges to replace the shared GraphQL schema via a read-only query endpoint. By sending a GraphQL type definition containing a crafted @sql directive to the /api/v1/quer...