SurrealDB EUVD-2026-97644

The target must run SurrealDB 3.0.0 through 3.2.x (fixed in 3.3.0) with network-reachable RPC. The primary path requires a low-privileged account holding VIEWER permission, which is used to run ACCESS SHOW ALL to harvest other users' grant identifiers; alternatively, an attacker who has obtained leaked grant identifiers or tokens can call the revoke RPC directly. The core defect is that the revoke RPC does not require proof of possession of the token being revoked. Exploitation is LIMITED to invalidating refresh tokens - it causes targeted forced re-authentication/session denial, and does not grant read access to data, code execution, or privilege escalation. The main mitigating factor is the need for either VIEWER-level access or previously leaked grant/token identifiers, which constrains fully anonymous abuse.

This is a medium-severity (CVSS 4.0 base 5.3) authentication/authorization flaw whose real-world risk is moderate and bounded. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack that requires low privileges - consistent with the description's note that a VIEWER-permission account can enumerate grant identifiers via ACCESS SHOW ALL. However, the description ALSO states 'unauthenticated callers' can abuse the revoke RPC, which partially conflicts with the vendor's PR:L rating; this suggests PR:L reflects the typical path (needing VIEWER to harvest grant IDs) while a fully unauthenticated path may exist if grant identifiers or tokens are leaked - verify the exact precondition with the GHSA advisory. Impact is deliberately narrow: VC:N (no confidentiality loss), VI:L and VA:L (limited integrity/availability - the attacker can invalidate other users' refresh tokens, forcing re-authentication, i.e. a targeted session-level denial of service rather than code execution or data theft). No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept was supplied, so there is no public exploit identified at time of analysis. Net: this is a legitimate authorization-hardening priority for SurrealDB operators on 3.0.0-3.2.x, but it is a limited-impact session-disruption bug, not a critical remote-code-execution or data-breach issue - patch on a normal cycle rather than as an emergency.

An attacker holding a low-privilege VIEWER account (or a leaked token) connects to a SurrealDB 3.0.0-3.2.x instance, runs ACCESS SHOW ALL to enumerate other users' grant identifiers, then invokes the revoke RPC method - which fails to verify proof of possession - to permanently invalidate those users' refresh tokens. The result is forced re-authentication / session disruption for the targeted accounts. No public proof-of-concept exploit was provided in the available data.