EUVD-2026-45906
GHSA-3f6w-45q9-v69m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity IDOR needing only valid low-privilege tenant credentials (PR:L), no user interaction; high confidentiality and integrity from cross-tenant data read/operations, no availability impact; S:U kept conservatively despite tenant-boundary crossing.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.
AnalysisAI
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belonging to other namespaces and databases by manipulating the scope in the URL path. Because the server fails to validate namespace/database scope on custom API routes, an attacker holding valid credentials for one tenant can read sensitive data or trigger unintended operations in unrelated tenants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a SurrealDB instance older than 3.2.0 that (2) defines custom API routes and (3) hosts more than one namespace/database (a multi-tenant deployment), and (4) the attacker must hold valid credentials for at least one namespace/database on that instance (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to a genuine, high-value confidentiality/integrity risk rather than a high-CVSS-but-low-impact issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A SaaS provider runs a shared SurrealDB cluster where each customer is a separate namespace/database and exposes custom API endpoints for its application. A paying (or trial) customer authenticates to their own tenant, then simply edits the namespace/database segment of the custom API URL to a competitor's scope and receives that tenant's data or triggers its operations. … |
| Remediation | Vendor-released patch: 3.2.0 - upgrade all SurrealDB instances to 3.2.0 or later, which adds namespace/database scope validation to custom API route handling; see the advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SurrealDB deployments and identify those operating in multi-tenant mode; document current versions and note any systems running versions before 3.2.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today