# CVE-2026-75846: ArcadeDB missing authorization in DELETE FUNCTION

Source: https://junglewise.ai/threats/cve-2026-75846-arcadedb-missing-authorization-in-delete-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75846 · Severity: high · CVSS 7.1 · Published 2026-08-18

ArcadeDB is a graph database platform used for storing and querying connected data. The DELETE FUNCTION SQL statement lacks proper authorization checks, allowing any user with database access to permanently remove server-side functions—including security-critical logic—without requiring schema update permissions. This can lead to loss of data integrity and service availability.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-75846 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75846 being exploited in the wild.

**How severe is CVE-2026-75846?** High severity, with a CVSS score of 7.1, published 18 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB before 26.8.1; affected versions <= 26.7.3.

**Is there a fix for CVE-2026-75846?** A patch was published on 2026-08-18: Fixed in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75846 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75846?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the DELETE FUNCTION SQL statement handler (DeleteFunctionStatement.executeSimple). The vulnerable code fails to call checkPermissionsOnDatabase(UPDATE_SCHEMA) before unregistering and persisting deletion of server-side functions to the database schema. Any authenticated database user can exploit this via the POST /api/v1/command/{db} API endpoint to permanently remove any registered function, including security-relevant logic. The root cause is that unregisterFunction() in both PolyglotFunctionLibraryDefinition and SQLFunctionLibraryDefinition lacks permission guards, while similar operations (unregisterFunctionLibrary) are properly protected. The fix is to add the missing authorization check at the start of DeleteFunctionStatement.executeSimple.

## Affected products

- ArcadeData ArcadeDB before 26.8.1; affected versions <= 26.7.3

## Timeline

- 2026-08-18: disclosed
- 2026-08-18: patched: Fixed in version 26.8.1

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vv82-qvpf-rjwv](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vv82-qvpf-rjwv)
- [https://www.vulncheck.com/advisories/arcadedb-before-unauthorized-function-deletion-via-delete-function](https://www.vulncheck.com/advisories/arcadedb-before-unauthorized-function-deletion-via-delete-function)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)