CVE-2026-75846

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.

• CWE-862

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vv82-qvpf-rjwv
• https://www.vulncheck.com/advisories/arcadedb-before-unauthorized-function-deletion-via-delete-function

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75840ArcadeDB before 26.8.1 contains an arbitrary file read vulne…7.5
• CVE-2026-75841ArcadeDB before 26.8.1 contains a denial of service vulnerab…4.3
• CVE-2026-75842ArcadeDB versions before 26.8.1 contain an arbitrary file re…7.7
• CVE-2026-75843ArcadeDB before 26.8.1 fails to bind the authenticated princ…9.9
• CVE-2026-75844ArcadeDB versions before 26.8.1 contain a server-side reques…7.1
• CVE-2026-75845ArcadeDB versions 26.4.2 through 26.7.3 contain an authoriza…6.3
• CVE-2026-75847Cleartext Storage of Sensitive Information vulnerability in …5.9
• CVE-2026-7585A vulnerability was determined in Open5GS up to 2.7.7. The i…4.3
• CVE-2026-75850ArcadeDB before 26.8.1 fails to bind the authenticated princ…4.2
• CVE-2026-75851ArcadeDB server (com.arcadedb:arcadedb-server) in versions 2…9.9
• CVE-2026-75852ArcadeDB versions before 26.8.1 fail to enforce SASL authent…9.8
• CVE-2026-75853ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcade…8.8