Description

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-15T16:17:13.560Z",
  "pubdate": "2026-09-15T16:17:13.560Z",
  "executiveSummary": "ArcadeDB versions prior to 26.6.1 are susceptible to an improper authorization vulnerability that permits authenticated users with read-only access to execute sensitive schema-altering operations.\nThe vulnerability stems from inconsistent security enforcement where critical schema mutators lack the necessary UPDATE_SCHEMA permission checks.\nAn attacker possessing a read-only API token can exploit these unprotected endpoints to perform unauthorized structural modifications, including dropping properties, renaming types, and altering database inheritance models.\nWhile the vulnerability does not allow for the direct extraction or unauthorized writing of record data, it enables significant disruption to the database integrity.\nBy manipulating the schema, an authenticated attacker can corrupt the semantics of stored records, bypass documented permission models, and effectively sabotage application logic relying on a stable database structure.\nThis represents a significant security risk for environments where database schema consistency is critical and where untrusted or low-privileged identities are granted authenticated access to the database's command and query HTTP endpoints.",
  "technicalDetails": "The root cause of this vulnerability is an incomplete implementation of access control mechanisms within the ArcadeDB schema management layer. Specifically, while the fix for CVE-2026-44221 introduced an UPDATE_SCHEMA authorization check for the 'LocalDocumentType.createProperty' function, this security enforcement was not propagated to other public schema mutators residing within 'engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java' and 'engine/src/main/java/com/arcadedb/schema/LocalProperty.java'.\nThe vulnerability allows authenticated identities—including those restricted to read-only API tokens—to invoke administrative operations through the database's command and query HTTP interfaces. Because the backend components responsible for executing these commands fail to validate the caller's permissions against the required UPDATE_SCHEMA authorization level, the system processes these requests as if they were originated by an authorized user.\nThe exploitation flow begins with the attacker establishing an authenticated session via an HTTP endpoint. Once authenticated, the attacker constructs and sends specific database commands or queries that leverage the exposed mutator functions. These include, but are not limited to, 'DROP PROPERTY', 'ALTER TYPE', and 'ALTER PROPERTY'. Upon receipt, the engine proceeds to execute the requested changes, such as renaming existing document types, modifying inheritance hierarchies, altering aliases, reassigning buckets, or changing data constraints (e.g., mandating or removing nullability/uniqueness constraints).\nThe impact of a successful exploit is significant regarding database integrity and architectural security. By dropping properties or altering type constraints, an attacker can effectively disable application functionality or render existing data unreadable by the application layer, which expects a specific schema structure. Furthermore, altering inheritance or bucket configurations can lead to unauthorized data mapping, where subsequent read operations may return inconsistent or misleading record sets, effectively breaching the logical security model of the database.\nThis issue remains present in all versions prior to 26.6.1. The attack surface is exposed via the HTTP API, requiring the attacker to have at least a baseline level of authenticated access. The vulnerability is characterized by a failure to enforce the Principle of Least Privilege across the API surface, leading to unauthorized state changes within the database schema."
}