Executive brief
SurrealDB is a multi-model database platform. A bug in the `DEFINE TABLE` statement's `OVERWRITE` clause prevents permission updates from taking effect when applied to tables defined with `TYPE RELATION`. This allows authenticated users with query access to retain or gain access to data they should not be able to read after an administrator attempts to restrict permissions on such tables.
Technical details
The vulnerability is an authorization bypass caused by incorrect permission assignment (CWE-732) in SurrealDB's `DEFINE TABLE` statement. When a user attempts to update table permissions for a relation-type table using the `OVERWRITE` clause, the operation silently fails to apply the new permissions while appearing to succeed. The vulnerable component is the table definition logic, affecting versions 2.0.0 through 2.1.3. Exploitation requires network access to a SurrealDB server and valid query credentials, making this a low-complexity attack with low privilege requirements. An authenticated attacker can exploit this to access or retain access to data in a relation-type table after permissions were intended to be revoked. The issue is patched in version 2.1.4 and later via fix #5260; affected users who cannot upgrade must delete and recreate the table definition from scratch.
Affected products
- SurrealDB SurrealDB 2.0.0 to 2.1.3
- SurrealDB surrealdb-core 2.0.0 to 2.1.3
Timeline
- 2024-12-16: disclosed: GHSA-27vq-hv74-7cqp published
- 2024-12-16: patched: Fix available in version 2.1.4