EUVD-2026-45923
GHSA-j8qv-6jr5-7pcx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable exploitation requires low-privilege authentication (PR:L); impact is integrity-only within the vulnerable system (I:L) with no confidentiality or availability effect and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.
AnalysisAI
Authorization bypass in SurrealDB before 3.1.0 allows authenticated users holding only CREATE permission on an edge table to silently overwrite existing edge records without possessing UPDATE permission. By crafting a RELATE statement with an explicit SET id clause pointing to an already-existing edge id, the storage layer skips the expected conflict check and performs an overwrite instead of returning an error - violating the permission boundary between CREATE and UPDATE operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 5.3 reflects the network-reachable but low-privilege, integrity-only impact.
Technical ContextAI
SurrealDB is a multi-model graph database written in Rust that models relationships via edge records created with the RELATE statement. The root cause is CWE-285 (Improper Authorization): the code path handling Statement::Relate used set_record at the storage layer, which performs an unconditional write without checking whether the target id already exists. A correctly-scoped create operation should call put_record, which returns a RecordExists error on collision, thereby enforcing the CREATE/UPDATE permission boundary. When an attacker supplies RELATE a:1 -> edge_table -> b:2 SET id = edge_table:existing, the existing record is replaced without SurrealDB ever consulting UPDATE permission. The confirmed patch (commit 79aef90d9baf56147d21f6dcea7a59189ade0eb3) adds an explicit Statement::Relate arm that calls put_record instead. The affected package is the Rust crate surrealdb in versions prior to 3.1.0.
RemediationAI
Upgrade the surrealdb Rust crate to version 3.1.0 or later; this is the vendor-released patch confirmed by the GHSA advisory and commit 79aef90d9baf56147d21f6dcea7a59189ade0eb3. Note that this upgrade is a breaking change for any application code that relied on RELATE ... SET id = ... to silently replace existing edges - those callers will now receive a RecordExists error and should migrate to UPSERT, which is correctly permission-gated for both CREATE and UPDATE semantics. If an immediate upgrade is not possible, two compensating controls are available: (1) Audit application code and prohibit use of RELATE ... SET id = ... with manually specified edge ids - default RELATE usage with auto-generated ids is unaffected by this vulnerability, because auto-generated ids cannot collide with existing records. (2) For use cases that require deterministic edge ids, add an application-layer pre-check that asserts no record with the target id exists before issuing the RELATE, or restrict CREATE permission on sensitive edge tables to principals who are also trusted with UPDATE on the same table. The vendor advisory is at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-f82j-v89j-mf86 and the VulnCheck advisory is at https://www.vulncheck.com/advisories/surrealdb-before-relate-statement-record-overwrite.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today