Skip to main content

ArcadeDB EUVDEUVD-2026-60610

| CVE-2026-75846 HIGH
Missing Authorization (CWE-862)
2026-08-18 VulnCheck GHSA-v5p2-j769-79j6
Authentication Bypass Arcadedb
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Network API with low-privilege credentials suffices; no scope change; no confidentiality loss; integrity is high due to permanent deletion; availability impact is low.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 18, 2026 - 12:02 EUVD
Analysis Generated
Aug 18, 2026 - 11:57 vuln.today
CVE Published
Aug 18, 2026 - 11:19 cve.org
HIGH 7.1

DescriptionCVE.org

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.

AnalysisAI

Missing authorization in ArcadeDB's DELETE FUNCTION SQL command allows any authenticated database user to permanently remove server-side functions regardless of their actual permission level. All releases up to and including 26.7.3 are affected; the issue is resolved in 26.8.1. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege ArcadeDB database credentials
Delivery
Send POST /api/v1/command/{db} with DELETE FUNCTION SQL
Exploit
Bypass missing UPDATE_SCHEMA authorization check
Execution
Permanently unregister and persist deletion of target function
Impact
Silently disable security or business logic dependent on that function
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid ArcadeDB database credential at any privilege level - the CVSS PR:L confirms that low-privilege authenticated access is sufficient, not administrator rights. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) is well-calibrated for this vulnerability: the network attack vector and low-privilege requirement mean any authenticated database account suffices, while VI:H reflects the severity of permanently deleting server-side functions - which may implement row-level access controls, audit hooks, or business-critical automations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding any valid ArcadeDB database credential - such as a read-only analyst account - sends a crafted HTTP POST to /api/v1/command/{databasename} with the SQL body DELETE FUNCTION securityAuditHook. ArcadeDB executes the deletion immediately and persists the change to disk without checking for UPDATE_SCHEMA privileges. …
Remediation The primary fix is to upgrade ArcadeDB to version 26.8.1 or later, which adds the missing UPDATE_SCHEMA permission check inside DeleteFunctionStatement.executeSimple(); full details are in the vendor advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vv82-qvpf-rjwv. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all ArcadeDB deployments in production and development environments and document their current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Arcadedb

View all
CVE-2026-75851 CRITICAL
9.4 Aug 18

Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
CVE-2026-75843 CRITICAL
9.4 Aug 18

Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
CVE-2026-67341 CRITICAL
9.3 Aug 01

Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
CVE-2026-67342 CRITICAL
9.3 Aug 01

Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
CVE-2026-75854 CRITICAL
9.3 Aug 18

Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
CVE-2026-75852 CRITICAL
9.3 Aug 18

Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
CVE-2026-76224 HIGH
8.7 Aug 19

Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
CVE-2026-67343 HIGH
8.7 Aug 01

Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
CVE-2026-67356 HIGH
8.7 Aug 02

Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
CVE-2026-67340 HIGH
8.6 Aug 01

Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
CVE-2026-75853 HIGH
8.7 Aug 18

Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
CVE-2026-75840 HIGH
8.7 Aug 18

Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-60610 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy