Missing Authorization in ArcadeDB's DELETE FUNCTION Leads to Critical Security Gaps

CVE-2026-75846

What is CVE-2026-75846?

ArcadeDB versions prior to 26.8.1 are susceptible to a missing authorization vulnerability within the DELETE FUNCTION SQL statement. This flaw allows any user with database access to execute the DELETE FUNCTION via the command API, leading to the permanent removal of registered server-side functions without appropriate permission verification. Such unchecked operations jeopardize the integrity and availability of the database, potentially eliminating essential security logic.

References