Incorrect Authorization Affecting com.arcadedb:arcadedb-engine package, versions [,26.6.1)

Affected versions of this package are vulnerable to Incorrect Authorization in the LocalDocumentType and LocalProperty schema-mutator methods. An attacker can mutate their database schema by sending DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY requests with an authenticated identity that lacks UPDATE_SCHEMA, including a read-only API token. This lets the attacker rename types, change inheritance, and alter property constraints on the affected database, breaking the meaning of stored records and bypassing the documented schema-permission model.

Notes

• LocalDocumentType and LocalProperty are only reachable through the SQL DDL path; in server deployments that expose the HTTP command/query endpoints, a read-only API token can reach the vulnerable mutators even though it lacks schema-write permission.
• The affected schema changes include type renames, supertype/alias/bucket changes, and property constraint/value metadata updates, so the impact is broader than just creating or dropping a property.

Workarounds

• Grant write access only to trusted users and API tokens; keep schema DDL (DROP PROPERTY, ALTER TYPE, ALTER PROPERTY) available only to administrators until you can upgrade. This prevents a read-only or otherwise untrusted identity from mutating the schema over the database command/query HTTP endpoints.

• GitHub Commit 26.6.1
• Maintainer's Advisory