ArcadeDB versions before 26.7.2 do not enforce the UPDATE_SCHEMA permission when executing ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL commands. An authenticated user who only has read access, such as a user associated with a read‑only API token, can send these commands through the HTTP command endpoint. This bypasses the intended permission boundary and allows the attacker to alter a type’s custom schema metadata or bucket‑selection strategy, potentially corrupting schema definitions and disrupting record routing within the database. The weakness is classified as a privilege‑escalation flaw, which can undermine the integrity and reliability of the database.

The vulnerability affects ArcadeData’s ArcadeDB product in all releases prior to version 26.7.2. Users deploying these affected versions are at risk if they provide read‑only tokens that could be exploited via the HTTP command interface.

The CVSS score of 8.5 indicates a high severity for this flaw. The EPSS score is not available, so the likelihood of exploitation is uncertain, and the issue is not catalogued in CISA’s KEV list. The attack requires only an authenticated session with read privileges, which are commonly granted, and can be executed from any client that can reach the HTTP command endpoint, making the vulnerability broadly exploitable by attackers who have obtained or guessed valid credentials.