Executive brief
SurrealDB, a multi-model database, is affected by a vulnerability that allows users to bypass security rules intended to isolate data between different tenants or users. By modifying editable fields in a record they already control, an attacker can trick the database into granting them access to other records they should not be able to see. This could lead to unauthorized data access or the creation of duplicate records that violate database integrity rules.
Technical details
SurrealDB is vulnerable to an authorization bypass (CWE-639/CWE-863) when evaluating permissions or UNIQUE constraints that reference parts of a composite record ID (e.g., `id.tenant`). The root cause is that the value-path resolver incorrectly reads these values from the record's editable body fields rather than the immutable record ID key. An authenticated attacker with write access to any record can spoof these fields to match the ID components of target records, thereby bypassing tenant-isolation rules or causing UNIQUE constraint violations. This issue affects Object-keyed record IDs and is resolved in version 3.1.0 by ensuring the resolver reads directly from the ID key.
Affected products
- surrealdb surrealdb < 3.1.0
Timeline
- 2026-05-13: patched: Fix committed to repository
- 2026-05-27: disclosed: Advisory published by maintainers
- 2026-07-01: advisory: GitHub Advisory reviewed and updated