CVE-2026-67344
Received Received - Intake

ArcadeDB Schema Metadata Manipulation via ALTER TYPE

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access (e.g., a read-only API token) can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundary and potentially corrupting schema metadata and record routing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67344
EUVD
EUVD-2026-51807

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB before version 26.7.2 does not enforce the UPDATE_SCHEMA permission for ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations. This allows authenticated users with only read access to modify type metadata and bucket selection strategy via HTTP endpoints, bypassing intended permission checks.

Impact Analysis

An attacker with read-only access could corrupt schema metadata or alter record routing, potentially causing data integrity issues, unauthorized data access, or system instability. This could disrupt database operations and lead to data loss or incorrect query results.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized modifications to data structures, potentially compromising data integrity and access controls. Organizations may fail to meet GDPR's integrity and confidentiality principles or HIPAA's access control requirements due to insufficient permission enforcement.

Mitigation Strategies

Upgrade ArcadeDB to version 26.7.2 or later to address the permission bypass issue. Ensure all users follow the principle of least privilege by restricting UPDATE_SCHEMA permissions to authorized personnel only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart