Surrealdb: Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path

SurrealDB versions prior to 3.2.0 fail to validate namespace and database scope in custom API routes. Authenticated users with valid credentials for any namespace or database can specify a different namespace/database in the URL path to access custom API endpoints belonging to other tenants. This vulnerability can result in unauthorized reading of sensitive data or triggering unintended operations across tenant boundaries. The issue is tracked as GHSA-3f6w-45q9-v69m and is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with valid credentials for any namespace or database can bypass intended access controls by specifying arbitrary namespace/database scopes in the URL path. This can lead to unauthorized access to sensitive data or execution of operations in other tenants' namespaces/databases, potentially compromising confidentiality and integrity. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users should monitor SurrealDB advisories for updates. Until a fix is available, restrict access to authenticated users carefully and consider limiting custom API route usage or adding additional validation controls to prevent scope override via URL path.