Description

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T12:19:35.173Z",
  "pubdate": "2026-08-18T12:19:35.173Z",
  "executiveSummary": "ArcadeDB before 26.8.1 (affected versions <= 26.7.3) suffers from a missing authorization vulnerability residing within the DELETE FUNCTION SQL statement implementation. This security flaw enables any authenticated user with database access to execute the DELETE FUNCTION command via the command API at POST /api/v1/command/{db}, resulting in the unauthorized, permanent removal of registered server-side functions. The impact of this vulnerability directly targets system integrity and operational availability by allowing unauthorized actors to purge critical server-side logic, including security-relevant functions. The exploitation vector is network-based and exposes the database to potential disruption without requiring elevated administrative privileges, provided the attacker possesses basic database access permissions. Mitigation requires updating ArcadeDB to version 26.8.1 or later to enforce proper access control checks during function deletion routines.",
  "technicalDetails": "The root cause of this vulnerability stems from an absence of access control verification within the DeleteFunctionStatement.executeSimple routine in ArcadeDB. Specifically, when processing a DELETE FUNCTION SQL statement, the application fails to execute the necessary checkPermissionsOnDatabase function utilizing the UPDATE_SCHEMA permission level. Consequently, the application processes the command by unregistering and persisting the deletion of server-side functions without validating whether the requesting entity possesses the administrative authorization required to modify database schemas or server functions. Exploitation occurs via the HTTP command API endpoint POST /api/v1/command/{db}, where an attacker submits a crafted HTTP request containing the unauthorized DELETE FUNCTION payload. The attack flow involves a standard HTTP POST request directed at the exposed command API with valid database credentials of a standard, non-privileged user. Upon receipt, the ArcadeDB command parser routes the execution to DeleteFunctionStatement.executeSimple. Because the requisite privilege validation logic is omitted in the vulnerable component, the backend bypasses security checks, removes the designated server-side function from the internal registry, and persists the deletion state across the storage layer. The affected versions comprise all iterations of ArcadeDB up to and including version 26.7.3. The network exposure is tied directly to the REST API endpoints provided by the database server. Post-exploitation impact includes severe degradation of application integrity and availability, as critical business logic, data validation scripts, and security-relevant functions can be permanently erased by unauthorized users, leading to operational downtime or bypassed security controls."
}