Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 20 July 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-05-27: Fix released in SurrealDB 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

SurrealDB graph traversal bypasses table SELECT permissions

Severity: medium · CVSS 6.5 · Published 2026-07-20

SurrealDB is a multi-model database used to store and query structured data. Authenticated users can bypass table-level access controls by traversing graph edges or relationships, allowing them to read sensitive records that should be restricted. This means an attacker with valid credentials can access confidential information they should not see, potentially exposing customer data or business-critical records.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) < 3.1.0.
Is there a fix for This vulnerability?: A patch was published on 2026-05-27: Fix released in SurrealDB 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authorization bypass vulnerability (CWE-863, CWE-200) affecting SurrealDB's graph traversal and relationship traversal features. The root cause is that GraphEdgeScan and ReferenceScan operations fetched records directly from storage without routing them through the Document::pluck_select permission check, causing the target table's PERMISSIONS FOR select clause to be ignored. An authenticated record or scope user can chain graph edges or REFERENCES TO back-references to read records on any table reachable from a table they have select access to, even when the target table has PERMISSIONS FOR select NONE. The vulnerability is bounded to the current database and does not bypass namespace or database isolation. SurrealDB 3.1.0 and later include a fix via a per-batch permission cache that validates SELECT permissions for each target table.

Affected products

SurrealDB SurrealDB < 3.1.0

Timeline

2026-05-27: disclosed: Original advisory GHSA-vjjx-rfw4-rmfc published
2026-05-27: patched: Fix released in SurrealDB 3.1.0
2026-07-20: other: Duplicate advisory GHSA-4q5r-gwcx-24m9 published
2026-09-04: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.