CVE-2026-75846 in ArcadeDB
Summary
by MITRE • 08/18/2026
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in ArcadeDB versions prior to 26.8.1 represents a critical failure in access control mechanisms within the database management system's SQL execution engine. Specifically, this flaw resides in the handling of the DELETE FUNCTION statement, which is designed to remove server-side functions registered within the database schema. The core technical deficiency lies in the DeleteFunctionStatement.executeSimple method, which proceeds directly with unregistering and persisting the deletion of a function without invoking any permission verification routines. In a properly secured implementation, such an operation should require explicit authorization checks against the UPDATE_SCHEMA privilege level to ensure that only users with elevated administrative rights can modify the database schema structure. The absence of this check means that the system fails to validate whether the executing user possesses the necessary authority to alter security-critical components of the application logic.
This missing authorization flaw allows any authenticated user who has basic access to a specific database instance to execute arbitrary DELETE FUNCTION commands through the RESTful command API endpoint located at POST /api/v1/command/{db}. By leveraging this interface, an attacker with low-privilege credentials can permanently remove server-side functions that may contain essential business logic or security controls. The impact on system integrity is severe because it enables unauthorized modification of the application's executable code base stored within the database. Furthermore, the availability aspect is compromised as critical functionalities dependent on these deleted functions will cease to operate correctly, potentially leading to service degradation or complete outage depending on which specific functions are targeted by the malicious actor.
From a classification perspective, this vulnerability aligns with CWE-269, Improper Privilege Management, and more specifically CWE-862, Missing Authorization, as the system fails to enforce required access controls for sensitive operations. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this flaw facilitates techniques associated with Defense Evasion or Impact categories where an attacker might remove security-relevant logic to maintain persistence or disrupt services without detection by standard privilege-based monitoring tools. The ability to manipulate schema elements via a web-accessible API further amplifies the risk profile compared to vulnerabilities restricted solely to local console access.
To mitigate this vulnerability, organizations running affected versions of ArcadeDB must upgrade immediately to version 26.8.1 or later where the permission check on database operations for function deletion has been implemented. Until an upgrade is feasible, administrators should restrict network-level access to the command API endpoint to only trusted internal networks and enforce strict firewall rules that limit exposure to external entities. Additionally, implementing a Web Application Firewall with specific rule sets capable of detecting and blocking SQL-like injection patterns or unauthorized schema modification attempts can provide a layer of compensatory control. It is also advisable to audit existing user roles and permissions within the database environment to ensure that no unnecessary high-level privileges are granted to accounts requiring only read access, thereby reducing the attack surface available to potential adversaries exploiting this flaw.