What is CVE-2026-75846?
A missing authorization vulnerability in ArcadeDB before 26.8.1 (affected versions <= 26.7.3) allows unauthorized deletion of server-side functions via the DELETE FUNCTION SQL statement. The flaw exists because `DeleteFunctionStatement.executeSimple` lacks a `checkPermissionsOnDatabase` (UPDATE_SCHEMA) check. Affected systems should be immediately updated to version 26.8.1 or later.
Azərbaycanca: ArcadeDB-nin 26.8.1-dən əvvəlki versiyalarında (<=26.7.3) DELETE FUNCTION SQL əmri vasitəsilə server-side funksiyaların icazəsiz silinməsinə imkan verən boşluq aşkarlanıb. Bu zəiflik `DeleteFunctionStatement.executeSimple` metodunda `checkPermissionsOnDatabase` yoxlanışının olmaması səbəbindən yaranır. Təsirlənən sistemlərdə dərhal 26.8.1 və ya daha yeni versiyaya yenilənmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-862; shared vendor: ArcadeDB
FAQ2
What is the root cause of CVE-2026-75846 in ArcadeDB?
The vulnerability exists because the `DeleteFunctionStatement.executeSimple` method lacks a permissions check (`checkPermissionsOnDatabase`, specifically `UPDATE_SCHEMA`) on the database.
Which version should be updated to in order to mitigate CVE-2026-75846?
Affected systems should be immediately updated to ArcadeDB version 26.8.1 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.