Executive brief
ArcadeDB is a graph database platform used for storing and querying connected data. The DELETE FUNCTION SQL statement lacks proper authorization checks, allowing any user with database access to permanently remove server-side functions—including security-critical logic—without requiring schema update permissions. This can lead to loss of data integrity and service availability.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the DELETE FUNCTION SQL statement handler (DeleteFunctionStatement.executeSimple). The vulnerable code fails to call checkPermissionsOnDatabase(UPDATE_SCHEMA) before unregistering and persisting deletion of server-side functions to the database schema. Any authenticated database user can exploit this via the POST /api/v1/command/{db} API endpoint to permanently remove any registered function, including security-relevant logic. The root cause is that unregisterFunction() in both PolyglotFunctionLibraryDefinition and SQLFunctionLibraryDefinition lacks permission guards, while similar operations (unregisterFunctionLibrary) are properly protected. The fix is to add the missing authorization check at the start of DeleteFunctionStatement.executeSimple.
Affected products
- ArcadeData ArcadeDB before 26.8.1; affected versions <= 26.7.3
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: Fixed in version 26.8.1