Surrealdb: Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions

SurrealDB before version 3.2.0 contains a vulnerability (CWE-863) where data-modifying statements such as CREATE, UPDATE, DELETE, or UPSERT embedded inside PERMISSIONS clauses bypass the intended table permission enforcement. This flaw enables attackers who have permission to perform guarded operations to write to tables without proper authorization, leading to unintended data modifications and corruption. The advisory is marked as a duplicate of GHSA-66r2-5gwj-gxm2 and has been withdrawn to preserve external references.

The vulnerability allows unauthorized data modification by bypassing table permission checks when data-modifying statements are placed inside PERMISSIONS clauses. This can lead to unintended writes and data corruption. There is no indication of confidentiality or availability impact. The CVSS score is 4.3 (medium severity), reflecting limited impact primarily on data integrity.

Patch status is not yet confirmed — check the vendor advisory GHSA-66r2-5gwj-gxm2 for current remediation guidance. No official patch or fix information is provided in this advisory. Until a fix is available, restrict permissions to minimize risk and monitor for suspicious use of PERMISSIONS clauses.