ArcadeDB CVE-2026-75846

Exploitation requires a valid ArcadeDB database credential at any privilege level - the CVSS PR:L confirms that low-privilege authenticated access is sufficient, not administrator rights. The attacker must have network access to the ArcadeDB HTTP command API (POST /api/v1/command/{db}). The target database must have at least one server-side function registered; if no functions exist, the DELETE FUNCTION call fails harmlessly. Factors that limit practical impact include: organizations that have not defined server-side functions lose nothing meaningful; those that have restricted all command API access to a single high-privilege service account are not exposed to lateral misuse. The vulnerability does not affect confidentiality - no data is disclosed - and does not enable code execution; impact is confined to integrity (permanent function deletion) and limited availability (disruption of function-dependent logic).

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) is well-calibrated for this vulnerability: the network attack vector and low-privilege requirement mean any authenticated database account suffices, while VI:H reflects the severity of permanently deleting server-side functions - which may implement row-level access controls, audit hooks, or business-critical automations. VA:L captures the availability disruption to function-dependent workflows. No CISA KEV listing exists and no public exploit has been identified, so this is not confirmed as actively exploited; however, the trivial attack path (a single API call with standard credentials) means that even a mid-sized municipal IT team in swidnica running ArcadeDB with security-relevant server-side functions should treat patching as urgent rather than routine. The main limiting factor for blast radius is that impact scales with how heavily an organization relies on server-side functions for security enforcement; deployments that do not use server-side functions face negligible practical impact.

An attacker holding any valid ArcadeDB database credential - such as a read-only analyst account - sends a crafted HTTP POST to /api/v1/command/{databasename} with the SQL body DELETE FUNCTION securityAuditHook. ArcadeDB executes the deletion immediately and persists the change to disk without checking for UPDATE_SCHEMA privileges. If the deleted function was enforcing row-level access control or audit logging, its removal silently disables those controls for all subsequent database operations, with no error or warning raised to administrators.