CVE-2026-75846

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description A missing authorization issue exists in the DELETE FUNCTION SQL statement. The DeleteFunctionStatement.executeSimple() function unregisters and persists the deletion of a server-side function without performing a checkPermissionsOnDatabase (UPDATE SCHEMA) check. This allows any user with database access to use the 'POST /api/v1/command/{db}' API endpoint to permanently remove any registered server-side function, including security-relevant logic, which impacts system integrity and availability.

Recommendations Update ArcadeDB to version 26.8.1 or later.