CVE-2026-76223 Overview
CVE-2026-76223 is a missing authorization flaw [CWE-862] in ArcadeDB (com.arcadedb). Versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission when a DEFINE FUNCTION statement targets an existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change. This enables tampering with admin-defined function logic used across the database. JavaScript functions are not affected because they still trigger the UPDATE_SECURITY check. The issue is fixed in version 26.8.1.
Critical Impact
Low-privileged database users can overwrite admin-defined SQL and Cypher functions, tampering with server-side logic executed by other users and applications.
Affected Products
- ArcadeDB com.arcadedb versions 26.7.3 and earlier
- ArcadeDB deployments exposing SQL or Cypher function libraries
- Applications relying on ArcadeDB admin-defined SQL or Cypher functions
Discovery Timeline
- 2026-08-19 - CVE-2026-76223 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-76223
Vulnerability Analysis
ArcadeDB supports function libraries containing SQL, Cypher, and JavaScript functions callable from queries. Schema modifications should require the UPDATE_SCHEMA privilege. Function definitions written in JavaScript also require the UPDATE_SECURITY privilege because they execute arbitrary code.
The DEFINE FUNCTION statement fails to perform the UPDATE_SCHEMA authorization check when the target function library already exists. As a result, any authenticated user with basic database access can invoke DEFINE FUNCTION to insert new SQL or Cypher functions into an existing library or replace functions defined by administrators. The change is persisted to the schema and applies to all subsequent invocations by other users.
Attackers can substitute admin-authored logic with attacker-controlled queries. Functions used for authorization decisions, data filtering, or workflow gating can be replaced to return attacker-selected values, bypass business logic, or exfiltrate data to which the attacker would not otherwise have direct access.
Root Cause
The root cause is a missing authorization check on the code path handling DEFINE FUNCTION against pre-existing libraries. The check is present when creating new libraries but was omitted when the library already existed, allowing unprivileged writes to admin-managed schema objects.
Attack Vector
The flaw is exploitable over the network by any authenticated user with low privileges. The attacker connects to ArcadeDB and issues a DEFINE FUNCTION statement targeting an existing library and function name, replacing the SQL or Cypher body with attacker-controlled logic that executes when other users call the function.
See the GitHub Security Advisory and the VulnCheck Advisory for ArcadeDB for additional detail.
Detection Methods for CVE-2026-76223
Indicators of Compromise
- Unexpected DEFINE FUNCTION statements in ArcadeDB query or audit logs originating from non-administrative accounts
- Function bodies in existing libraries that differ from known-good administrator-authored versions
- New or modified SQL or Cypher functions with timestamps that do not match scheduled deployments
Detection Strategies
- Compare current function definitions in each library against a version-controlled baseline of admin-approved functions
- Alert on any DEFINE FUNCTION command issued by users lacking the UPDATE_SCHEMA role
- Enable and forward ArcadeDB query logs to a SIEM and correlate schema-modification statements with the invoking user identity
Monitoring Recommendations
- Track schema-change events for function libraries and require review of any diff
- Monitor authentication events for low-privilege accounts issuing DDL-style statements
- Retain query logs long enough to reconstruct the sequence of function definitions during incident response
How to Mitigate CVE-2026-76223
Immediate Actions Required
- Upgrade ArcadeDB com.arcadedb to version 26.8.1 or later, which enforces the UPDATE_SCHEMA check on all DEFINE FUNCTION paths
- Audit existing function libraries and restore any SQL or Cypher functions that were modified by non-administrator accounts
- Rotate credentials for any low-privileged accounts that may have been used to tamper with schema objects
Patch Information
The vulnerability is fixed in ArcadeDB 26.8.1. The patch restores the UPDATE_SCHEMA authorization check on the DEFINE FUNCTION code path when the target library already exists. Refer to the GitHub Security Advisory GHSA-rv64-62hr-wv2p for release notes and commit references.
Workarounds
- Restrict database access to trusted users only until the upgrade to 26.8.1 is completed
- Remove non-essential SQL and Cypher functions from shared libraries so that tampering surface is minimized
- Review and tighten role assignments so that only administrators can connect to databases hosting sensitive function libraries
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
