Executive brief
SurrealDB is a multi-model database used to store and query structured data. Authenticated users can bypass table-level access controls by traversing graph edges or relationships, allowing them to read sensitive records that should be restricted. This means an attacker with valid credentials can access confidential information they should not see, potentially exposing customer data or business-critical records.
Technical details
This is an authorization bypass vulnerability (CWE-863, CWE-200) affecting SurrealDB's graph traversal and relationship traversal features. The root cause is that GraphEdgeScan and ReferenceScan operations fetched records directly from storage without routing them through the Document::pluck_select permission check, causing the target table's PERMISSIONS FOR select clause to be ignored. An authenticated record or scope user can chain graph edges or REFERENCES TO back-references to read records on any table reachable from a table they have select access to, even when the target table has PERMISSIONS FOR select NONE. The vulnerability is bounded to the current database and does not bypass namespace or database isolation. SurrealDB 3.1.0 and later include a fix via a per-batch permission cache that validates SELECT permissions for each target table.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: disclosed: Original advisory GHSA-vjjx-rfw4-rmfc published
- 2026-05-27: patched: Fix released in SurrealDB 3.1.0
- 2026-07-20: other: Duplicate advisory GHSA-4q5r-gwcx-24m9 published
- 2026-09-04: other: Duplicate advisory withdrawn