ArcadeDB GHSA-vg6x-6g9j-6qwq: Schema modification by read-only users (CVE-2026-44221)

Vulnerability Summary: ArcadeDB Database Schema Can Be Modified by Read-Only Users Overview Vulnerability ID: GHSA-vg6x-6g9j-6qwq (CVE-2026-44221) Severity: High (CVSS 8.1/10) Description: The fix for CVE-2026-44221 (GHSA-hc7-ln93-6q77) only added an permission check to , but other methods that modify the database schema (such as , etc.) were not checked. Consequently, authenticated users holding a read-only API token (lacking the permission) can still modify the database schema on their own database. Impact: - - / (changes the inheritance hierarchy) - ( can be a type) - Type aliases and tracking changes - ( ) - These operations do not directly expose or write record data, but they change the meaning of every stored record, violating the documented permission model, which grants as the authorized permission for schema changes. Affected Scope Affected Components: - Engine schema layer: and , via the SQL , , and statements, as well as the database command/query HTTP endpoints. Affected Versions: , versions Fixed Version: Remediation Patch: Every method in and that modifies the database schema now enforces through a shared helper method. This check is a no-op in embedded mode and system contexts; unbounded users (those loading schemas at startup, applying HA replication) and internal paths are unaffected. Interim Mitigation: At the application layer, restrict schema DDL to administrators only until the upgrade is complete. References Incomplete fix: CVE-2026-44221 / GHSA-hc7-ln93-6q77 Acknowledgments Reporter: Kai Zen (SnailSnip)

Goal Reached Thanks to every supporter — we hit 100%!

ArcadeDB GHSA-vg6x-6g9j-6qwq: Schema modification by read-only users (CVE-2026-44221)

More from this source