Executive brief
SurrealDB is a multi-model database used for managing structured and unstructured data. A security flaw in versions prior to 3.1.0 allows authenticated users to bypass data isolation rules, such as those separating different customers (tenants) in a shared database. By manipulating specific data fields, an attacker could gain unauthorized access to records they should not be able to see or create duplicate entries that violate database integrity rules.
Technical details
An authorization bypass exists in SurrealDB's handling of composite record IDs. When a permission rule or UNIQUE constraint references a component of a composite ID (e.g., id.tenant), the database engine incorrectly resolves the value from the record's editable body fields rather than the immutable record ID key. An authenticated attacker with write access to a record can set a body field with the same name as an ID component to a spoofed value. This allows the attacker to satisfy permission checks (such as 'WHERE id.tenant = $auth.id.tenant') and access records or bypass unique constraints. The vulnerability is fixed in version 3.1.0 by ensuring the value-path resolver reads directly from the RecordIdKey.
Affected products
- surrealdb surrealdb < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date