The CRAN submission policies don't specifically prohibit a package that relies on a database connection, however, there are a couple of caveats to this.
From the CRAN policies:
- Packages which use Internet resources should fail gracefully with an informative message if the resource is not available or has changed (and not give a check warning nor error).
- Packages should not write in the user’s home filespace (including clipboards), nor anywhere else on the file system apart from the R session’s temporary directory (or during installation in the location pointed to by
TMPDIR : and such usage should be cleaned up). Installing into the system’s R installation (e.g., scripts to its bin directory) is not allowed.
- Downloads of additional software or data as part of package installation or startup should only use secure download mechanisms (e.g., ‘https’ or ‘ftps’). For downloads of more than a few MB, ensure that a sufficiently large timeout is set.
Given those policies above, your package should pass a CRAN review as long as when the database is unavailable the package gives a reasonable error message, you're not leaking any information about the user in the database request, and your requests are encrypted.