CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.8.1 are vulnerable due to a missing authorization check in the DELETE FUNCTION SQL statement, allowing any user with database access to execute the DELETE FUNCTION command. This flaw enables unauthorized deletion of server-side functions, potentially compromising the integrity and availability of the database by removing critical security logic. Organizations using affected versions should prioritize immediate remediation to prevent exploitation of this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.