Description

ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScript functions still trigger the UPDATE_SECURITY check and are not affected.)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T14:17:48.740Z",
  "pubdate": "2026-08-19T14:17:48.740Z",
  "executiveSummary": "ArcadeDB versions 26.7.3 and earlier suffer from an access control enforcement vulnerability involving the DEFINE FUNCTION statement. Specifically, the application fails to validate the required UPDATE_SCHEMA permission when an execution targets an already-existing function library. This authorization bypass allows authenticated users with standard database access privileges to add, modify, or overwrite custom SQL or Cypher functions within established libraries and persist these changes directly to the database.\nThe primary impact of this flaw is unauthorized function tampering, enabling malicious actors to manipulate administrative-defined function logic, potentially leading to data manipulation, privilege escalation, or arbitrary execution paths within the database context. Exploitation requires standard database access credentials but circumvents the intended role-based security boundaries by omitting the necessary administrative schema update validation checks. The vulnerability affects all deployments utilizing vulnerable versions of com.arcadedb prior to the patched release, making prompt remediation essential for securing administrative database functions against internal tampering.",
  "technicalDetails": "The root cause of the vulnerability resides in the authorization logic governing the DEFINE FUNCTION statement handling within ArcadeDB. When processing schema-altering statements that interact with function libraries, the application correctly enforces security checks for certain languages, such as JavaScript which properly triggers the UPDATE_SECURITY check. However, for SQL and Cypher function definitions targeting pre-existing function libraries, the execution flow fails to evaluate the mandatory UPDATE_SCHEMA permission check.\nThe vulnerable component involves the function management and schema validation subsystems of ArcadeDB com.arcadedb. An attacker possessing standard, low-privileged database access can craft a malicious DEFINE FUNCTION statement targeting an existing function library. Because the authorization engine omits the UPDATE_SCHEMA validation step for this specific condition, the parser accepts the statement, allowing the user to overwrite or inject arbitrary SQL or Cypher function logic.\nThe attack flow proceeds as follows: 1) The authenticated low-privileged user connects to the ArcadeDB instance. 2) The user formulates a DEFINE FUNCTION statement designed to modify or replace routines within an existing administrative function library using SQL or Cypher syntax. 3) The user submits the statement to the database engine. 4) The application processes the request, fails to enforce the UPDATE_SCHEMA permission check for the existing library, and persists the unauthorized modifications. 5) Subsequent executions of the tampered function execute the attacker-controlled logic under the context of the function's execution privileges.\nAffected versions include com.arcadedb versions 26.7.3 and earlier. The issue is fully resolved in version 26.8.1. Network exposure depends on the database deployment configuration, while authentication is required at the database user level, though privileges are restricted to basic database access rather than explicit schema administration rights."
}