Missing Authorization Vulnerability in ArcadeDB DELETE FUNCTION Statement

ArcadeDB versions 26.7.3 and earlier contain a missing authorization vulnerability in the DELETE FUNCTION SQL statement. The underlying issue exists within the DeleteFunctionStatement.executeSimple method, which fails to perform a checkPermissionsOnDatabase(UPDATE_SCHEMA) verification before unregistering and persisting the deletion of a server-side function. This allows any user who has established a connection to the database to execute a DELETE FUNCTION command via the HTTP Command API. By targeting the /api/v1/command/{db} endpoint, an unprivileged user can permanently remove critical server-side functions, including those governing security-relevant logic. This vulnerability (CVE-2026-75846) directly impacts the integrity and availability of the database environment by enabling unauthorized function destruction. Defenders should prioritize patching to version 26.8.1 or later to remediate the missing authorization check.

Impact

Successful exploitation allows unauthorized users to delete any server-side function within the database. This leads to the destruction of custom application logic, potential disruption of security controls that rely on server-side functions, and general loss of service integrity. There is no requirement for administrative privileges to execute the malicious command, making this a significant risk for multi-tenant or shared-access database environments.

Recommendation

• Upgrade ArcadeDB installations to version 26.8.1 or later immediately to patch CVE-2026-75846.
• Inspect web server or application proxy logs for POST requests to the /api/v1/command/ endpoint containing 'DELETE FUNCTION' SQL strings.
• Restrict access to the Command API to known, trusted application service accounts using network-level controls or authentication middleware.