Executive brief
ArcadeDB, a multi-model database engine, contains a flaw where users with read-only access can modify the database structure (schema). While this does not allow direct theft of data, an attacker could rename tables, delete property definitions, or change data validation rules. This can lead to data corruption, application errors, and a complete breakdown of the database's intended security and organizational model.
Technical details
An incomplete fix for a previous vulnerability (CVE-2026-44221) left several schema-mutating methods in LocalDocumentType and LocalProperty unprotected. Authenticated attackers with low privileges can execute SQL commands such as DROP PROPERTY, ALTER TYPE, and ALTER PROPERTY via HTTP endpoints to bypass the UPDATE_SCHEMA permission requirement. This allows for the modification of inheritance hierarchies, type renames, and property constraint changes (e.g., MANDATORY, REGEXP). The vulnerability is rooted in missing checkPermissionsOnDatabase(UPDATE_SCHEMA) calls in the engine's schema layer. A fix is available in version 26.6.1 which centralizes these checks.
Affected products
- ArcadeData arcadedb-engine < 26.6.1
Timeline
- 2026-06-03: patched: Release 26.6.1 published
- 2026-06-05: disclosed: Initial report by Kai Aizen
- 2026-07-16: advisory: GitHub Advisory published