EUVD-2026-45926
GHSA-4f9v-jpx9-mjvw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query interface (AV:N/AC:L) requiring any authenticated principal (PR:L) yields full table disclosure (C:H) with no integrity or availability impact and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user - including Record and Scope users - can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL's THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries.
AnalysisAI
Broken authorization in SurrealDB before 3.1.0 lets any authenticated principal - including low-privilege Record and Scope users - read the full contents of every table in their current database, bypassing PERMISSIONS FOR SELECT WHERE controls. The flaw stems from the engine evaluating user-supplied WHERE (and SET/MERGE/CONTENT/PATCH) expressions against complete record data before running the table-level SELECT permission check, so side-effecting expressions exfiltrate data the caller should never see. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold valid authentication to the target database at any privilege level (CVSS PR:L), including the lowest-trust Record or Scope users, and must be able to submit SELECT or update-variant (UPDATE/UPSERT/INSERT ON DUPLICATE KEY UPDATE/RELATE) statements with an attacker-controlled WHERE, SET, MERGE, CONTENT, or PATCH clause. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) scores 7.1 and is internally consistent with the description: network-reachable, low complexity, requires low-privilege authentication (PR:L), and yields high confidentiality impact with no integrity or availability impact - matching a read-only permission-bypass that discloses arbitrary table data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privilege Record or Scope user authenticated to a shared database submits a SELECT (or update-variant) statement whose WHERE clause embeds a side-effecting expression, causing the engine to leak record fields from a table they lack SELECT permission on. With --allow-scripting enabled they exfiltrate rows directly; otherwise they use THROW to surface data in error messages or measure query timing to reconstruct it row by row. … |
| Remediation | Upgrade to SurrealDB 3.1.0 or later, which reorders enforcement so check_permissions_table runs before any user-supplied expression is evaluated (fix commit 500f4060349580b9cbb9c07b8112a487551c4616; advisory GHSA-98fx-66cf-fc7c). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: verify your SurrealDB version in production and document which tables contain sensitive data, customer information, or regulated content. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today