Security risk of $update_access_free = true in Drupal

Question

What kind of potential security risk it raises if I left $update_access_free = TRUE in Drupal on a production environment? In that case, everyone can run update.php. Assuming there are no updates available, what can an attacker do?

Answer 1

If left enabled, an attacker could run old updates, which in a good scenario would only bog down your site's performance, but in a worst-case scenario could result in data loss or data corruption.