Duplicate Advisory: SurrealDB: Graph traversal bypasses table SELECT permissions

SurrealDB versions prior to 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. This means that an authenticated user can access records from any table connected via graph edges regardless of the target table's SELECT permission settings. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and has a CVSS v3.1 base score of 6.5, indicating a high severity impact primarily due to unauthorized data disclosure. There is no patch link provided in the data, and no known exploits in the wild have been reported. This advisory is a duplicate of GHSA-vjjx-rfw4-rmfc and has been withdrawn to preserve references.

The vulnerability allows authenticated users to bypass table-level SELECT permissions during graph traversal, resulting in unauthorized read access to records in tables they should not have permission to access. This leads to potential exposure of sensitive information without affecting data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory GHSA-vjjx-rfw4-rmfc for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigation steps.