Surrealdb core: SurrealDB: Writes in a PERMISSIONS clause bypass table permissions (CVE-2026-63733)

In SurrealDB versions before 3.2.0, a PERMISSIONS clause containing data-modifying statements (e.g., CREATE, UPDATE) is evaluated with permission enforcement disabled. This flaw allows the clause to perform writes to tables even if the caller lacks write permissions on those tables. For example, a PERMISSIONS clause for updating a 'post' table could create records in a 'log' table without the caller having permission to write to 'log'. The clause is evaluated once per matched record, potentially causing multiple unauthorized writes. The vulnerability does not permit escaping the caller's namespace or database, nor does it allow root-level actions or data disclosure. The issue is fixed in SurrealDB 3.2.0 by rejecting permission clauses that contain writes and blocking writes during permission evaluation at runtime.

An attacker with permission to perform an operation guarded by a vulnerable PERMISSIONS clause can write to tables they normally cannot modify within their own database namespace. This can lead to unauthorized data modification, unintended event triggers, cascades, or data corruption. The vulnerability does not allow privilege escalation beyond the caller's namespace or database, nor does it allow reading of hidden data or performing root-level actions. The impact is limited to integrity violations within the affected database.

A fix is available in SurrealDB version 3.2.0 and later, which enforces that PERMISSIONS clauses are read-only and blocks any writes during permission evaluation. Users should upgrade to version 3.2.0 or later to remediate this vulnerability. For those unable to patch immediately, review all PERMISSIONS clauses and remove any that contain data-modifying statements such as CREATE, UPDATE, DELETE, RELATE, INSERT, or UPSERT. Additionally, restrict who can define schema and vet imported data to prevent introduction of malicious permission clauses.