ArcadeDB versions before 26.8.1 allow a database user who does not have UPDATE_SCHEMA permission to execute the DEFINE FUNCTION statement against an existing function library. This omission lets the user add or replace SQL or Cypher functions, thereby persisting unauthorized changes to admin‑defined logic. The flaw is a classic access control issue (CWE-862), enabling privileged operations without proper authorization and potentially exposing the database to malicious code or data manipulation.

All installed instances of ArcadeData ArcadeDB version 26.7.3 or earlier are vulnerable. The issue was resolved in version 26.8.1; JavaScript function definitions continue to enforce the UPDATE_SECURITY check and remain unaffected.

The vulnerability carries a CVSS score of 7.1. EPSS data is unavailable. It is not listed in the CISA KEV catalog. A compromised database user with ordinary access can exploit the flaw by issuing DEFINE FUNCTION commands, a local or in‑application attack vector. Once exploited, the attacker can alter existing function libraries, leading to persistence of malicious logic and potential downstream exploitation of applications relying on those functions. The risk is significant in environments where database roles are not strictly audited or where untrusted users have schema modification capabilities.