Is CVE-2026-54076 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54076 being exploited in the wild.

How severe is CVE-2026-54076?

High severity, with a CVSS score of 8.1, published 15 September 2026.

Which products and versions are affected?

ArcadeData Arcadedb-Engine < 26.6.1; com.arcadedb:arcadedb-engine (Maven) < 26.6.1, ECOSYSTEM:introduced=0,fixed=26.6.1.

Is there a fix for CVE-2026-54076?

Yes. com.arcadedb:arcadedb-engine (Maven): upgrade to 26.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54076 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54076?

Check whether you run ArcadeData Arcadedb-Engine or com.arcadedb:arcadedb-engine (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54076: ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for added an UPDATE_SCHEMA authorization check only to LocalDocument

Q: Is there a fix for CVE-2026-54076?

Yes. com.arcadedb:arcadedb-engine (Maven): upgrade to 26.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54076 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54076?

Check whether you run ArcadeData Arcadedb-Engine or com.arcadedb:arcadedb-engine (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54076 · Severity: high · CVSS 8.1 · Published 2026-09-15

ArcadeDB, a multi-model database engine, contains a flaw where users with read-only access can modify the database structure (schema). While this does not allow direct theft of data, an attacker could rename tables, delete property definitions, or change data validation rules. This can lead to data corruption, application errors, and a complete breakdown of the database's intended security and organizational model.

Technologies: com.arcadedb:arcadedb-engine (Maven). Vendors: ArcadeData, Maven.

Quick answers

Is CVE-2026-54076 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54076 being exploited in the wild.
How severe is CVE-2026-54076?: High severity, with a CVSS score of 8.1, published 15 September 2026.
Which products and versions are affected?: ArcadeData Arcadedb-Engine < 26.6.1; com.arcadedb:arcadedb-engine (Maven) < 26.6.1, ECOSYSTEM:introduced=0,fixed=26.6.1.
Is there a fix for CVE-2026-54076?: Yes. com.arcadedb:arcadedb-engine (Maven): upgrade to 26.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54076 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54076?: Check whether you run ArcadeData Arcadedb-Engine or com.arcadedb:arcadedb-engine (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

com.arcadedb:arcadedb-engine (Maven): upgrade to 26.6.1 or later

# set com.arcadedb:arcadedb-engine to 26.6.1 in your pom.xml or build.gradle

Technical details

An incomplete fix for a previous vulnerability (CVE-2026-44221) left several schema-mutating methods in LocalDocumentType and LocalProperty unprotected. Authenticated attackers with low privileges can execute SQL commands such as DROP PROPERTY, ALTER TYPE, and ALTER PROPERTY via HTTP endpoints to bypass the UPDATE_SCHEMA permission requirement. This allows for the modification of inheritance hierarchies, type renames, and property constraint changes (e.g., MANDATORY, REGEXP). The vulnerability is rooted in missing checkPermissionsOnDatabase(UPDATE_SCHEMA) calls in the engine's schema layer. A fix is available in version 26.6.1 which centralizes these checks.

Affected products

ArcadeData arcadedb-engine < 26.6.1

Identifiers

CVE-2026-54076
GHSA-vg6x-6pg9-6qwg

Timeline

2026-06-03: patched: Release 26.6.1 published
2026-06-05: disclosed: Initial report by Kai Aizen
2026-07-16: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.