Missing Authorization in ArcadeDB DELETE FUNCTION Statement

Executive Summary

CVE-2026-75846 is a missing authorization vulnerability in ArcadeDB versions before 26.8.1. It allows any authenticated user with database access to delete server-side functions via the DELETE FUNCTION SQL statement without proper permission checks. This occurs because the DeleteFunctionStatement.executeSimple method unregisters and persists function deletions without verifying UPDATE_SCHEMA permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check ArcadeDB server logs for DELETE FUNCTION commands sent via POST /api/v1/command/{db} endpoints. Monitor for unauthorized function deletions in server-side function libraries. Verify if any user with basic database access executed DELETE FUNCTION statements without UPDATE_SCHEMA privileges.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to permanently remove critical server-side functions, including security-related logic. This would compromise data integrity by erasing important functions and reduce system availability by disrupting functionality dependent on those functions. The attack requires only basic database access and no special privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized deletion of security-relevant functions. GDPR requires data integrity and security measures, while HIPAA mandates protection of sensitive health data. Unauthorized function deletion risks violating these requirements by compromising system integrity and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade ArcadeDB to version 26.8.1 or later. Review server-side functions for unauthorized deletions. Implement strict access controls to restrict DELETE FUNCTION command execution. Add permission checks for UPDATE_SCHEMA before allowing function deletions.

Useful 0 Not Useful 0