CVE-2026-75846: ArcadeDB Auth Bypass Vulnerability

CVE-2026-75846 Overview

CVE-2026-75846 is a missing authorization vulnerability [CWE-862] in ArcadeDB versions at or below 26.7.3. The flaw resides in the DELETE FUNCTION SQL statement handler, which fails to enforce database-level permission checks before removing server-side functions. Any authenticated user with database access can invoke the command through the HTTP command API and permanently delete registered functions, including those implementing security-relevant logic. The issue primarily affects data integrity and availability of the database's application layer.

Critical Impact
Low-privileged database users can delete arbitrary server-side functions, including security controls, via the POST /api/v1/command/{db} endpoint without triggering an authorization check.

Affected Products

ArcadeDB versions <= 26.7.3
ArcadeDB releases prior to 26.8.1
Deployments exposing the POST /api/v1/command/{db} HTTP API

Discovery Timeline

2026-08-18 - CVE-2026-75846 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75846

Vulnerability Analysis

ArcadeDB supports server-side functions that can be registered, invoked, and removed through SQL statements executed against the HTTP command API. The DELETE FUNCTION statement is handled by DeleteFunctionStatement.executeSimple, which unregisters the target function and persists that removal to disk. The handler omits the checkPermissionsOnDatabase(UPDATE_SCHEMA) guard that other schema-modifying statements enforce.

Because the check is absent, the server accepts and processes the deletion for any principal that can reach the command endpoint with valid credentials for the target database. The result is silent removal of registered logic without an authorization decision. Functions that implement input validation, access control, or auditing can be erased, weakening downstream security posture.

Root Cause

The root cause is a missing authorization check in the code path for DELETE FUNCTION. Schema mutations in ArcadeDB are expected to require the UPDATE_SCHEMA permission on the database. DeleteFunctionStatement.executeSimple skips this verification and proceeds directly to unregister and persist the deletion, treating any authenticated database user as authorized to modify the function registry.

Attack Vector

An attacker with valid credentials for any database on the ArcadeDB server sends an HTTP POST request to /api/v1/command/{db} containing a DELETE FUNCTION SQL statement. No elevated role, schema privilege, or user interaction is required. The command executes over the network, and the targeted function is removed from the registry and from persistent storage. Repeat invocations can enumerate and eliminate additional functions.

For technical details, see the GitHub Security Advisory GHSA-vv82-qvpf-rjwv and the VulnCheck Advisory on ArcadeDB.

Detection Methods for CVE-2026-75846

Indicators of Compromise

HTTP POST requests to /api/v1/command/{db} containing the string DELETE FUNCTION in the request body.
Server logs showing successful execution of DeleteFunctionStatement by non-administrative accounts.
Unexpected absence of previously registered server-side functions after schema comparisons.
Application errors referencing missing functions invoked by legitimate queries or triggers.

Detection Strategies

Inspect HTTP access logs for DELETE FUNCTION statements issued by users that should not modify schema.
Baseline the list of registered server-side functions and alert on deltas between known-good snapshots.
Correlate command API activity with authentication events to identify low-privileged accounts issuing schema-altering SQL.

Monitoring Recommendations

Forward ArcadeDB HTTP and query logs to a centralized log platform for retention and search.
Alert on any invocation of DELETE FUNCTION, CREATE FUNCTION, or other schema-modifying statements outside change-management windows.
Track the version banner reported by ArcadeDB instances to identify hosts still running <= 26.7.3.

How to Mitigate CVE-2026-75846

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later on all servers.
Inventory registered server-side functions and validate that no critical function has been removed.
Restrict network exposure of the ArcadeDB HTTP API to trusted management networks.
Review database user roles and revoke access for accounts that do not require it.

Patch Information

The vulnerability is fixed in ArcadeDB 26.8.1. The patch adds the missing checkPermissionsOnDatabase(UPDATE_SCHEMA) enforcement to the DELETE FUNCTION execution path so only principals with schema-update rights can remove server-side functions. Refer to the GitHub Security Advisory GHSA-vv82-qvpf-rjwv for release details.

Workarounds

Place the ArcadeDB command API behind a reverse proxy that blocks request bodies containing DELETE FUNCTION until patching completes.
Limit database accounts so only trusted administrators hold credentials that can reach the command endpoint.
Take regular backups of the function registry so deleted server-side functions can be restored quickly.

bash

# Example reverse-proxy filter (nginx) blocking DELETE FUNCTION on the command API
location ~ ^/api/v1/command/ {
    if ($request_body ~* "DELETE\s+FUNCTION") {
        return 403;
    }
    proxy_pass http://arcadedb_backend;
}