CVE-2026-75846: ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATESCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any authenticated user with access to the affected database can exploit the issue through the command API. The attack requires no user interaction and can target any registered server-side function, including functions used for security-relevant logic.
Does an attacker need schema modification privileges?
The vulnerable DELETE FUNCTION path does not enforce the UPDATE_SCHEMA permission check. As a result, database access alone is sufficient for deletion; the user does not need schema-update authorization.
How can I determine whether my deployment is affected?
Affected systems are ArcadeDB versions 26.7.3 and earlier, before 26.8.1. Determine exposure by checking the deployed ArcadeDB version and whether untrusted or lower-privileged users have database access to the command API.
What can be done if an upgrade is not immediately possible?
Restrict database access and limit access to the POST /api/v1/command/{db} command endpoint to trusted users until upgrading. Review registered server-side functions and investigate unexpected deletions, particularly for functions involved in security controls or application workflows.