PT-2026-78405

ArcadeDB com.arcadedb versions 26.7.3 and earlier fail to enforce the UPDATE SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the...

CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67340

ArcadeDB (a Java multi-model database) versions before 26.7.2 allow post-authentication remote code execution via JavaScript trigger scripts. The ScriptTriggerExecutor includes java.lang.* in the GraalVM polyglot host-class allow-list, so an authenticated user with only the UPDATE_SCHEMA permissi...

CVE-2026-67344

ArcadeDB before 26.7.2 is affected: ALTER TYPE operations for CUSTOM and BUCKETSELECTIONSTRATEGY do not enforce UPDATE_SCHEMA, allowing an authenticated user with only read access (e.g., a read‑only API token) to mutate a type’s custom schema metadata and bucket‑selection strategy via the HTTP co...

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

Impact The fix for CVE-2026-44221 GHSA-fxc7-fm93-6q77 added an UPDATESCHEMA authorization check to a single schema-mutating method LocalDocumentType.createProperty. The remaining public schema mutators were left unchecked, so an authenticated identity including a read-only API token that lacks th...