CVE-2026-76223: ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION
ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATESCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScript functions still trigger the UPDATESECURITY check and are not affected.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDB (com.arcadedb)to a version that resolves this vulnerability.Fixed in 26.8.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with database access can exploit it if they can issue a DEFINE FUNCTION statement against an existing function library. The vulnerable permission check is not enforced for that operation.
What function types are affected?
SQL and Cypher functions in an existing library can be added or overwritten. JavaScript functions are not affected because they still trigger the UPDATE_SECURITY permission check.
Which versions need remediation?
ArcadeDB 26.7.3 and earlier are affected. The issue is fixed in version 26.8.1.
How can I determine whether tampering may have occurred?
Review existing SQL and Cypher function libraries for functions that were added or modified by accounts that had database access but should not have had schema-update privileges.