CVE-2026-67344Disclosure

LOWCVSS 8.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access (e.g., a read-only API token) can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundary and potentially corrupting schema metadata and record routing.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
3 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-67344 ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, … https://www.cve.org/CVERecord?id=CVE-2026-67344 ----- Traducción: CVE-2026-67344 Arc… http://infoflow.cloud`
Post summary
A new CVE (CVE-2026-67344) for ArcadeDB has been announced, revealing a permission bypass that allows unauthorized schema updates.
0000034
96 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-67344 ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, … https://www.cve.org/CVERecord?id=CVE-2026-67344
Post summary
The text provides the technical details of a permission bypass vulnerability in ArcadeDB, indicating that the UPDATE_SCHEMA permission is not enforced for certain ALTER TYPE operations.
00000576
57.9K followersView on X
MalwareObserver@MalwareObserver91d
Disclosure
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-67344](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8vr5-263f-x5r3) ... https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8vr5-263f-x5r3 #CVE #ZeroDay #PatchManagement
Post summary
The post announces the new CVE-2026-67344, linking to the official advisory and encouraging users to apply the available patch, but it provides no PoC, exploit details, or technical description of the flaw.
0000099
18 followersView on X

Explore more

Back to dashboard