CVE-2026-76223

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description Insufficient enforcement of the UPDATE SCHEMA permission check occurs when a DEFINE FUNCTION statement targets an existing function library. This allows a user with only database access to add or overwrite SQL or Cypher functions within an existing library and persist those changes, which enables the tampering of admin-defined function logic. JavaScript functions are not affected as they still trigger the UPDATE SECURITY check.

Recommendations Update to version 26.8.1.