ArcadeDB EUVD-2026-62464

Exploitation requires a valid ArcadeDB database user account (PR:L confirmed by CVSS 4.0 vector). The targeted function library must already exist in the database - DEFINE FUNCTION against a non-existent library correctly enforces the UPDATE_SCHEMA permission check and is not exploitable. Only SQL and Cypher function libraries are affected; JavaScript function libraries are protected by a separate UPDATE_SECURITY permission check and are out of scope. No special deployment configuration, elevated network position, or additional privilege beyond basic authenticated database access is required. Limiting factors: anonymous or unauthenticated access is insufficient; the attacker must be able to issue DEFINE FUNCTION statements, which implies at minimum query execution rights on the target database instance.

The CVSS 4.0 score of 7.1 (High) with AV:N/AC:L/AT:N/PR:L/UI:N correctly captures a moderately serious risk that is bounded by the PR:L requirement - exploitation demands a valid, authenticated database account. This materially limits the attacker pool to insiders, compromised application credentials, or users in shared multi-tenant ArcadeDB deployments. No CISA KEV listing exists and no public exploit code is identified at time of analysis, so this is not a spray-and-pray internet threat. EPSS data was not provided in the input, so exploitation probability cannot be independently quantified. The dominant risk signal is VI:H: a successful attack permanently alters admin-authored function definitions, and those changes persist across restarts and affect every caller of the modified library until detected. The secondary VA:L signal likely reflects disruption from corrupted function behavior in dependent queries. This is a genuine remediation priority for organizations with multi-user ArcadeDB instances, particularly those where untrusted or shared credentials have database access.

An attacker holding a low-privilege ArcadeDB database account - such as a shared application service credential or a compromised user account - connects to the database over the network and issues a crafted DEFINE FUNCTION statement targeting an existing SQL or Cypher library. Because the UPDATE_SCHEMA permission check is absent for this code path, the statement succeeds silently and overwrites an admin-authored function - for example, replacing a data-validation or access-control routine with one that bypasses checks or exfiltrates query parameters. The overwritten function persists across database restarts and executes in place of the legitimate version for all subsequent callers, including administrative processes.