Executive brief
SurrealDB is a multi-model database. A vulnerability in its 'RELATE' command allows users who only have permission to create new data to accidentally or intentionally overwrite existing data. This could allow an authorized user to modify records they should not have access to change, potentially compromising the integrity of the database.
Technical details
A vulnerability in SurrealDB's handling of the RELATE statement allows for an authorization bypass. When a RELATE statement includes a 'SET id = ...' clause pointing to an existing record, the storage layer silently overwrites the existing edge instead of returning an error. This occurs because the operation incorrectly used 'set_record' (which overwrites) instead of 'put_record' (which respects existing records) during the creation path. An authenticated attacker with CREATE permissions on an edge table can thus modify any record in that table, even if they lack UPDATE permissions. The issue is fixed in version 3.1.0 by ensuring conflicting writes return a RecordExists error.
Affected products
- surrealdb surrealdb < 3.1.0
Timeline
- 2026-05-27: disclosed
- 2026-07-01: advisory
- 2026-07-01: patched: Fixed in version 3.1.0
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-f82j-v89j-mf86
- https://github.com/surrealdb/surrealdb/commit/79aef90d9baf56147d21f6dcea7a59189ade0eb3
- https://github.com/orgs/surrealdb/discussions/110
- https://api.github.com/repos/surrealdb/surrealdb/security-advisories/GHSA-f82j-v89j-mf86