SurrealDB CVE-2026-109340

Exploitation requires (1) an authenticated SurrealDB account (PR:L) that (2) holds delete permission on a table referenced by a REFERENCE relationship, and (3) a schema where that reference uses ON DELETE CASCADE and the target edge table relies on a PERMISSIONS FOR delete clause as its access boundary. The flaw affects versions 3.1.0 up to but not including 3.3.0. Limiting factors: the attacker must already be authenticated and already authorized to delete the referenced parent record, so it is not remotely reachable by anonymous users; it is only meaningful where per-table PERMISSIONS are used as a trust boundary (e.g. multi-tenant setups), and impact is limited to deletion of edges (integrity/availability), with no confidentiality exposure.

This is a moderate, authenticated-only authorization-bypass (CWE-862) rated CVSS 5.3 via the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with only low integrity and availability impact (VI:L/VA:L) and no confidentiality impact (VC:N) and no scope change to other systems. The signals are internally consistent: network-reachable but requiring existing privileges (PR:L), low complexity, no user interaction. There is no CISA KEV listing and no public exploit identified, and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - this is a confined privilege/permission-enforcement flaw rather than a mass-exploitation threat. The practical risk is bounded to multi-tenant or shared SurrealDB deployments where an attacker already holds a legitimate account with delete permission on a referenced table; in single-trust-boundary deployments the impact is minimal. Net assessment: a legitimate correctness/authorization bug worth patching in environments that rely on per-table PERMISSIONS as a security boundary, but not an urgent fire-drill given authenticated-only access, no confidentiality impact, and no exploitation evidence.

In a multi-tenant SurrealDB instance, a low-privileged authenticated user who has been granted delete permission on a referenced (parent) table deletes a record that participates in a REFERENCE ON DELETE CASCADE relationship. The cascade cleanup erases graph edges in a separate edge table even though that edge table's PERMISSIONS FOR delete clause should have blocked the user, letting them tamper with data they were never authorized to remove. No public proof-of-concept was identified at the time of analysis.