EUVD-2026-60610
GHSA-v5p2-j769-79j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege ArcadeDB database credentials
-
DeliverySend POST /api/v1/command/{db} with DELETE FUNCTION SQL
-
ExploitBypass missing UPDATE_SCHEMA authorization check
-
ExecutionPermanently unregister and persist deletion of target function
-
ImpactSilently disable security or business logic dependent on that function
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid ArcadeDB database credential at any privilege level - the CVSS PR:L confirms that low-privilege authenticated access is sufficient, not administrator rights. The attacker must have network access to the ArcadeDB HTTP command API (POST /api/v1/command/{db}). The target database must have at least one server-side function registered; if no functions exist, the DELETE FUNCTION call fails harmlessly. Factors that limit practical impact include: organizations that have not defined server-side functions lose nothing meaningful; those that have restricted all command API access to a single high-privilege service account are not exposed to lateral misuse. The vulnerability does not affect confidentiality - no data is disclosed - and does not enable code execution; impact is confined to integrity (permanent function deletion) and limited availability (disruption of function-dependent logic). |
| Impact | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) is well-calibrated for this vulnerability: the network attack vector and low-privilege requirement mean any authenticated database account suffices, while VI:H reflects the severity of permanently deleting server-side functions - which may implement row-level access controls, audit hooks, or business-critical automations. VA:L captures the availability disruption to function-dependent workflows. No CISA KEV listing exists and no public exploit has been identified, so this is not confirmed as actively exploited; however, the trivial attack path (a single API call with standard credentials) means that even a mid-sized municipal IT team in swidnica running ArcadeDB with security-relevant server-side functions should treat patching as urgent rather than routine. The main limiting factor for blast radius is that impact scales with how heavily an organization relies on server-side functions for security enforcement; deployments that do not use server-side functions face negligible practical impact. |
| Exploit ScenarioDerived | An attacker holding any valid ArcadeDB database credential - such as a read-only analyst account - sends a crafted HTTP POST to /api/v1/command/{databasename} with the SQL body DELETE FUNCTION securityAuditHook. ArcadeDB executes the deletion immediately and persists the change to disk without checking for UPDATE_SCHEMA privileges. If the deleted function was enforcing row-level access control or audit logging, its removal silently disables those controls for all subsequent database operations, with no error or warning raised to administrators. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Missing authorization in ArcadeDB's DELETE FUNCTION SQL command allows any authenticated database user to permanently remove server-side functions regardless of their actual permission level. All releases up to and including 26.7.3 are affected; the issue is resolved in 26.8.1. No public exploit has been identified at time of analysis, but the low barrier - a valid database credential and a single API call - makes this easily reachable by insiders or compromised low-privilege accounts, particularly where server-side functions enforce security or business logic.
RemediationAI
The primary fix is to upgrade ArcadeDB to version 26.8.1 or later, which adds the missing UPDATE_SCHEMA permission check inside DeleteFunctionStatement.executeSimple(); full details are in the vendor advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vv82-qvpf-rjwv. If immediate upgrade is not feasible, restrict network access to the ArcadeDB command API endpoint (POST /api/v1/command/{db}) at the perimeter or reverse-proxy layer to only trusted, privileged service accounts - note the trade-off that this reduces API availability for all users, not only DELETE FUNCTION callers. As a detection measure until patching, enable and monitor ArcadeDB audit logs for any DELETE FUNCTION statement execution, which should be rare in normal operations. Deployments that do not register server-side functions face minimal risk from this specific vulnerability but should still upgrade to receive the authorization fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ArcadeDB is a multi-model NoSQL database that exposes a REST command API at POST /api/v1/command/{db} accepting SQL-like statements including the DELETE FUNCTION command. The vulnerability exists in the Java class DeleteFunctionStatement.executeSimple(), which unregisters the named function and persists that deletion to disk without first invoking checkPermissionsOnDatabase(UPDATE_SCHEMA) - the authorization gate that restricts schema-modifying operations to sufficiently privileged users. CWE-862 (Missing Authorization) precisely describes the root cause: the code path correctly identifies the operation to perform but omits the access-control decision entirely before executing it. The affected CPE is cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:* covering all versions up to and including 26.7.3.
Know when Arcadedb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Network API with low-privilege credentials suffices; no scope change; no confidentiality loss; integrity is high due to permanent deletion; availability impact is low.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.
Executive ViewAI
ArcadeDB versions through 26.7.3 suffer from an access control gap in database function management that enables any authenticated user to irreversibly delete server-side functions, potentially dismantling critical application security controls and business logic enforcement. This creates operational and security risk through both insider threats and compromised low-privilege accounts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Exploit-DB