{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/arcadedb-gremlin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-75846"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ArcadeDB","ArcadeDB (\u003c= 26.7.3)","arcadedb-gremlin"],"_cs_severities":["high"],"_cs_tags":["vulnerability","privilege-escalation","database-security","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["ArcadeDB"],"content_html":"\u003cp\u003eArcadeDB versions 26.7.3 and earlier contain a missing authorization vulnerability in the DELETE FUNCTION SQL statement. The underlying issue exists within the DeleteFunctionStatement.executeSimple method, which fails to perform a checkPermissionsOnDatabase(UPDATE_SCHEMA) verification before unregistering and persisting the deletion of a server-side function. This allows any user who has established a connection to the database to execute a DELETE FUNCTION command via the HTTP Command API. By targeting the /api/v1/command/{db} endpoint, an unprivileged user can permanently remove critical server-side functions, including those governing security-relevant logic. This vulnerability (CVE-2026-75846) directly impacts the integrity and availability of the database environment by enabling unauthorized function destruction. Defenders should prioritize patching to version 26.8.1 or later to remediate the missing authorization check.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized users to delete any server-side function within the database. This leads to the destruction of custom application logic, potential disruption of security controls that rely on server-side functions, and general loss of service integrity. There is no requirement for administrative privileges to execute the malicious command, making this a significant risk for multi-tenant or shared-access database environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ArcadeDB installations to version 26.8.1 or later immediately to patch CVE-2026-75846.\u003c/li\u003e\n\u003cli\u003eInspect web server or application proxy logs for POST requests to the /api/v1/command/ endpoint containing 'DELETE FUNCTION' SQL strings.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Command API to known, trusted application service accounts using network-level controls or authentication middleware.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T14:35:22Z","date_published":"2026-08-18T12:54:04Z","id":"https://feed.craftedsignal.io/briefs/2026-08-arcadedb-auth-bypass/","summary":"ArcadeDB versions 26.7.3 and earlier are vulnerable to a missing authorization flaw allowing any authenticated database user to delete server-side functions via the command API.","title":"Missing Authorization Vulnerability in ArcadeDB DELETE FUNCTION Statement","url":"https://feed.craftedsignal.io/briefs/2026-08-arcadedb-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Arcadedb-Gremlin","version":"https://jsonfeed.org/version/1.1"}