EUVD-2026-45916
GHSA-6fpj-mjq4-fp9r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low complexity; PR:L because valid credentials required; S:C because cross-tenant data access breaches isolation boundary; no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.
AnalysisAI
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users to circumvent tenant-isolation and object-keyed permission rules by spoofing composite record-id field values through writable body fields. Attackers who can write to any record can set a same-named body field to an arbitrary value; because the permission evaluator incorrectly reads from the editable body rather than the immutable id key, PERMISSIONS FOR clauses gating access on id.<field> (the common pattern for tenant isolation) are silently defeated. No public exploit has been identified at time of analysis, and the vulnerability requires valid credentials, but the impact includes cross-tenant data exposure and silent UNIQUE constraint corruption. Fix is available in 3.1.0.
Technical ContextAI
SurrealDB is a multi-model database written in Rust that supports a record-oriented data model where each document carries a strongly-typed record id, which may be a composite object key (e.g., user:[{tenant: 'acme', uid: 42}]). Permission policies (DEFINE TABLE ... PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant) rely on reading named components of this id to enforce row-level isolation. The defect, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), arises in the value-path resolver: when evaluating a path like id.tenant, the resolver entered select_document and read from the record's mutable body fields rather than from the immutable RecordIdKey::Object components. Because body fields are user-writable but the id key is fixed at record creation, an attacker could set a body field named tenant to any value and have all id.tenant permission expressions evaluate against that spoofed value. The patch special-cases Part::Field and Part::Value against RecordIdKey::Object to always read directly from the id key. The vulnerability is scoped to object-keyed composite ids; array-indexed access (id[0]) is unaffected.
RemediationAI
Upgrade SurrealDB to version 3.1.0 or later; this is the vendor-confirmed fixed release per GHSA-6vg3-hgrw-p5gf and the associated commit at https://github.com/surrealdb/surrealdb/commit/1fcb19040bfffba92b3f69edb9b707d469e0027b. For deployments unable to patch immediately, the vendor recommends two compensating controls with meaningful trade-offs: first, rewrite permission expressions to gate on the full record id (WHERE id = $auth.id) rather than a named component (WHERE id.tenant = $auth.id.tenant) - this closes the bypass but requires schema and query review to ensure the full-id comparison still correctly expresses the intended policy; second, avoid UNIQUE indexes defined on id.<field> until patched, replacing them with DEFINE INDEX ... ON FIELDS id UNIQUE (full-id uniqueness) - this prevents constraint corruption but may require index redesign. Neither workaround addresses the root cause; upgrading to 3.1.0 is the definitive fix.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today