Authentication Bypass in ArcadeDB Affects Custom Schema Operations

CVE-2026-67344

What is CVE-2026-67344?

ArcadeDB versions before 26.7.2 contain a vulnerability that allows authenticated users with read-only access to manipulate the database schema. Specifically, the lack of enforced permissions on the ALTER TYPE operations enables these users to alter critical schema metadata and bucket-selection strategies via the HTTP command endpoint. This can result in unauthorized changes to data integrity, potentially leading to corrupt schemas and disrupted record routing.

References