CVE-2026-54076

ArcadeDB, an open-source multi-model DBMS, incompletely fixed the earlier CVE-2026-44221: the UPDATE_SCHEMA authorization check was added only to LocalDocumentType.createProperty, leaving the other public schema mutators in LocalDocumentType.java and LocalProperty.java unchecked. Any authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can issue DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY commands through the database HTTP command/query endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and modify property constraints. The flaw does not directly read or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breaks the documented permission model. All deployments running versions prior to 26.6.1 that expose the HTTP API to authenticated users are affected; the issue is fixed in version 26.6.1. No public proof of concept is known and there are no reports of in-the-wild exploitation.

What to do: Upgrade to ArcadeDB 26.6.1, which extends the UPDATE_SCHEMA check to all public schema mutators. Until patched, restrict access to the HTTP command/query endpoints to trusted identities, minimize and review issued API tokens (including read-only tokens), and audit logs for unexpected DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY operations — particularly those performed since the partial fix for CVE-2026-44221.