Table SELECT permission bypass via graph traversal in SurrealDB (CVE-2026-63746)

Authenticated record or scope users in SurrealDB can read records from any table reachable through graph edges or REFERENCES TO back-references, bypassing that table's PERMISSIONS FOR select clause entirely. The flaw exists because GraphEdgeScan and ReferenceScan fetch records directly from storage without invoking the permission evaluation code path, exposing full documents even when the target table is defined with PERMISSIONS FOR select NONE. The bypass extends through multi-hop edge chains, meaning any table transitively reachable from a table the user has select permission on is exposed; confidentiality impact is bounded to the caller's current database. Affected versions: - < 3.1.0 We recommend updating to: 3.1.0. CVSS 7.1 · our assessment: this_week Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-vjjx-rfw4-rmfc Details: https://vuln.today/cve/CVE-2026-63746