ArcadeDB versions prior to 26.8.1 allow any authenticated database user to delete server‑side functions. The DELETE FUNCTION SQL statement performs unlinking and persistence of the function without enforcing an UPDATE_SCHEMA permission check. Removing a server‑side function that contains security‑relevant logic undermines data integrity and can temporarily halt application functionality.

ArcadeDB deployments of version 26.7.3 or earlier are affected. The vulnerability targets the command API endpoint POST /api/v1/command/{db}. Users with database access are the audience.

The CVSS score of 7.1 indicates high severity. The EPSS score is not reported, and the vulnerability is not listed in the KEV catalog. Attackers can leverage any database connection to issue the DELETE FUNCTION command, making exploitation straightforward for an insider or an attacker who has compromised credentials. The primary impact is loss of integrity and availability, though it may also open avenues for disabling security checks.