CVE-2026-67344

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2

Description An issue exists where the system fails to enforce the UPDATE SCHEMA database permission during ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations. These operations map to the setCustomValue() and setBucketSelectionStrategy() functions in LocalDocumentType. An authenticated user with read-only access can use the HTTP command endpoint to modify a type's custom schema metadata and bucket-selection strategy, bypassing permission boundaries and potentially corrupting schema metadata and record routing.

Recommendations Update to version 26.7.2 or later.