# CVE-2026-109340: SurrealDB authorization bypass in graph edge deletion via CASCADE

Source: https://junglewise.ai/threats/cve-2026-109340-surrealdb-from-3-1-0-before-3-3-0-contains-an-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109340 · Severity: medium · CVSS 5.4 · Published 2026-10-12

SurrealDB is a multi-model database that supports graph structures with fine-grained permissions. An authenticated attacker with delete permissions on one table can bypass permission checks to delete protected records in another table's edge (relationship) records. This allows silent, unrecoverable data loss of business-critical relationship data that should have been protected.

Technologies: [Surrealdb](https://junglewise.ai/threats/technologies/surrealdb-surrealdb). Vendors: [SurrealDB](https://junglewise.ai/threats/vendors/surrealdb).

## Quick answers

**Is CVE-2026-109340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109340 being exploited in the wild.

**How severe is CVE-2026-109340?** Medium severity, with a CVSS score of 5.4, published 12 October 2026.

**Which products and versions are affected?** Surrealdb 3.1.0 before 3.3.0.

**Is there a fix for CVE-2026-109340?** Yes: fixed in 3.3.0. Until then: Restrict vertex DELETE permission on tables that are reference-cascade targets to only principals trusted to delete all connected edge records, or avoid using REFERENCE ON DELETE CASCADE where the referencing record is also a graph-edge endpoint whose edge table relies on PERMISSIONS FOR delete clauses.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-28"}, {"kind": "advisory", "at": "2026-10-12"}, {"kind": "patched", "at": "2026-09-28", "note": "Version 3.3.0 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109340 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109340?** Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.0

Restrict vertex DELETE permission on tables that are reference-cascade targets to only principals trusted to delete all connected edge records, or avoid using REFERENCE ON DELETE CASCADE where the referencing record is also a graph-edge endpoint whose edge table relies on PERMISSIONS FOR delete clauses.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-28"}, {"kind": "advisory", "at": "2026-10-12"}, {"kind": "patched", "at": "2026-09-28", "note": "Version 3.3.0 released"}]

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the cascade delete handling of REFERENCE ON DELETE CASCADE operations. When a record is deleted through a cascading reference, the permission context flag disables authorization checks for the cascading delete; this flag incorrectly persists into subsequent edge cleanup operations, bypassing the edge table's PERMISSIONS FOR delete clause. An authenticated attacker with delete permission on a referenced table can exploit this by deleting a record, causing its cascade to delete a graph edge endpoint without permission checks, thus erasing connected edge records despite protective permissions on the edge table.

## Affected products

- SurrealDB SurrealDB 3.1.0 before 3.3.0

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4w65-7h3j-p29h](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4w65-7h3j-p29h)
- [https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-authorization-bypass-via-reference-on-delete-cascade](https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-authorization-bypass-via-reference-on-delete-cascade)

## Related threats

- [SurrealDB unbounded recursion in value serialization](https://junglewise.ai/threats/cve-2026-121423-surrealdb-before-3-3-0-contains-an-unbounded-recursion)
- [SurrealDB server-side request forgery in JWKS URL validation](https://junglewise.ai/threats/cve-2026-121422-surrealdb-from-3-1-0-before-3-3-0-contains-a-server-side-request)
- [SurrealDB server-side request forgery in network deny rules](https://junglewise.ai/threats/cve-2026-121421-surrealdb-3-1-0-before-3-3-0-contains-a-server-side-request)
- [SurrealDB MCP session hijack via BoundSubject fingerprint collision](https://junglewise.ai/threats/cve-2026-121419-surrealdb-from-3-1-0-before-3-3-0-contains-an-improper)
- [SurrealDB authorization bypass via streaming index planner](https://junglewise.ai/threats/cve-2026-121418-surrealdb-from-3-1-0-before-3-3-0-contains-an-incorrect)