Incomplete authorization fix in ArcadeDB schema mutation operations (CVE-2026-54076)

CVE-2026-54076 is an incomplete fix of CVE-2026-44221 in ArcadeDB's engine schema layer, where the prior patch added an UPDATE_SCHEMA authorization check to only one schema-mutating method (LocalDocumentType.createProperty), leaving the remaining public schema mutators unchecked. An authenticated identity, including a read-only API token lacking the UPDATE_SCHEMA permission, can execute DDL operations such as DROP PROPERTY, ALTER TYPE, and ALTER PROPERTY to corrupt the database schema without authorization. Affected versions: - <= 26.5.1 We recommend updating to: 26.6.1. CVSS 8.1 · our assessment: this_week Vendor advisory: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vg6x-6pg9-6qwg Details: https://vuln.today/cve/CVE-2026-54076